MitreCVE-2007-5507CVE-2007-5507
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
AI Score
Confidence
Low
EPSS
Percentile
84.2%
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| oracle | database_server | 9.0.1.5 | cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:* |
| oracle | database_server | 9.2.0.8 | cpe:2.3:a:oracle:database_server:9.2.0.8:*:*:*:*:*:*:* |
| oracle | database_server | 9.2.0.8dv | cpe:2.3:a:oracle:database_server:9.2.0.8dv:*:*:*:*:*:*:* |
| oracle | database_server | 10.1.0.5 | cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:* |
| oracle | database_server | 10.2.0.3 | cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:* |
References
marc.info/?l=bugtraq&m=119332677525918&w=2
secunia.com/advisories/27251
secunia.com/advisories/27409
securityreason.com/securityalert/3250
www.ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-tns-listener/
www.oracle.com/technetwork/topics/security/cpuoct2007-092913.html
www.securityfocus.com/archive/1/482423/100/0/threaded
www.securityfocus.com/bid/26103
www.securitytracker.com/id?1018823
www.us-cert.gov/cas/techalerts/TA07-290A.html
www.vupen.com/english/advisories/2007/3524
www.vupen.com/english/advisories/2007/3626
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
AI Score
Confidence
Low
EPSS
Percentile
84.2%