Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   Oracle Application Server Vendors:   Oracle
Oracle Application Server Bugs Let Remote Users Modify Data and Let Local Users Access Data
SecurityTracker Alert ID:  1023058
SecurityTracker URL:
CVE Reference:   CVE-2009-1990, CVE-2009-1999, CVE-2009-3407   (Links to External Site)
Date:  Oct 20 2009
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Description:   Three vulnerabilities were reported in Oracle Application Server. A remote user can modify some data on the target database. A local user can access some data on the target database.

No details were provided.

The Business Intelligence Enterprise Edition [CVE-2009-1990, CVE-2009-1999] and Portal [CVE-2009-3407] products are affected.

The following researchers reported these and other Oracle vulnerabilities:

Yaniv Azaria of Imperva, Inc.; Cesar Cerrudo of Argeniss; Deniz Cevik of Intellect; Joxean Koret; Joxean Koret of iSIGHT Partners Global Vulnerability Partnership; Alexander Kornbrust of Red Database Security; David Litchfield of NGS Software; Ryan Permeh of McAfee Avert labs; Guy Pilosof of Sentrigo; Aviv Pode of Sentrigo; Alexandr Polyakov of Digital Security; Pawel Romanek of Asseco Business Solutions; Amichai Shulman of Imperva, Inc.; Rajat Swarup; Laszlo Toth; Luka Treiber of ACROS Security; Wei Wang of McAfee Avert labs; and Dennis Yurichev.

Impact:   A remote user can modify some data on the target database.

A local user can access some data on the target database.

Solution:   The vendor has issued a fix, described in their Oct 2009 Critical Patch Update advisory.

The Oracle advisory is available at:

[Editor's note: The CVE-2009-1999 vulnerability has already been fixed in all supported versions and the fix is not included in the patch.]

Vendor URL: (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC