Lucene search

[email protected]CVE-2007-3854

HistoryJul 18, 2007 - 7:30 p.m.

CVE-2007-3854

2007-07-1819:30:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2007-3854

oracle database

unspecified vulnerabilities

remote authenticated users

advanced queuing component

spatial component

sql injection

buffer overflow

nvd

7.5 High

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.005 Low

EPSS

Percentile

76.9%

JSON

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.

CPENameOperatorVersion
oracle:database_serveroracle database servereq10.2.0.3
oracle:application_serveroracle application servereq10.1.2.0.2
oracle:database_serveroracle database servereq9.0.1.5
oracle:peoplesoft_enterprise_customer_relationship_managementoracle peoplesoft enterprise customer relationship managementeq9.0
oracle:peoplesoft_enterprise_peopletoolsoracle peoplesoft enterprise peopletoolseq8.47
oracle:application_serveroracle application servereq10.1.3.2.0
oracle:application_serveroracle application servereq10.1.3.1.0
oracle:application_serveroracle application servereq10.1.2.1.0
oracle:peoplesoft_enterprise_peopletoolsoracle peoplesoft enterprise peopletoolseq8.48
oracle:application_serveroracle application servereq1.0.2.2

CPE	Name	Operator	Version
oracle:database_server	oracle database server	eq	10.2.0.3
oracle:application_server	oracle application server	eq	10.1.2.0.2
oracle:database_server	oracle database server	eq	9.0.1.5
oracle:peoplesoft_enterprise_customer_relationship_management	oracle peoplesoft enterprise customer relationship management	eq	9.0
oracle:peoplesoft_enterprise_peopletools	oracle peoplesoft enterprise peopletools	eq	8.47
oracle:application_server	oracle application server	eq	10.1.3.2.0
oracle:application_server	oracle application server	eq	10.1.3.1.0
oracle:application_server	oracle application server	eq	10.1.2.1.0
oracle:peoplesoft_enterprise_peopletools	oracle peoplesoft enterprise peopletools	eq	8.48
oracle:application_server	oracle application server	eq	1.0.2.2

Rows per page:

1-10 of 381

References

h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143

secunia.com/advisories/26114

secunia.com/advisories/26166

www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf

www.oracle.com/technetwork/topics/security/cpujul2007-087014.html

www.red-database-security.com/advisory/oracle_cpu_jul_2007.html

www.red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html

www.securitytracker.com/id?1018415

www.us-cert.gov/cas/techalerts/TA07-200A.html

www.vupen.com/english/advisories/2007/2562

www.vupen.com/english/advisories/2007/2635

exchange.xforce.ibmcloud.com/vulnerabilities/35490

exchange.xforce.ibmcloud.com/vulnerabilities/35497

7.5 High

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.005 Low

EPSS

Percentile

76.9%

JSON

Related for CVE-2007-3854

prion1 nessus2