Vulnerability CVE-2004-1368


Published: 2004-08-04   Modified: 2012-02-12

Description:
ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.

Type:

CWE-noinfo

Vendor: Oracle
Product: Oracle9i 
Version:
standard_9.2.0.5
standard_9.2.0.4
standard_9.2.0.3
standard_9.2.0.2
standard_9.2.0.1
standard_9.2
standard_9.0.2
standard_9.0.1.5
standard_9.0.1.4
standard_9.0.1.3
standard_9.0.1.2
standard_9.0.1
standard_9.0
standard_8.1.7
personal_9.2.0.5
personal_9.2.0.4
personal_9.2.0.3
personal_9.2.0.2
personal_9.2.0.1
personal_9.2
personal_9.0.1.5
personal_9.0.1.4
personal_9.0.1
personal_8.1.7
enterprise_9.2.0.5
enterprise_9.2.0.4
enterprise_9.2.0.3
enterprise_9.2.0.2
enterprise_9.2.0.1
enterprise_9.2.0
enterprise_9.0.1.5
enterprise_9.0.1.4
enterprise_9.0.1
enterprise_8.1.7
client_9.2.0.2
client_9.2.0.1
Product: Oracle10g 
Version:
standard_9.0.4_.0
standard_10.1_.0.2
personal_9.0.4_.0
personal_10.1_.0.2
enterprise_9.0.4_.0
enterprise_10.1.0.2
Product: Oracle8i 
Version:
standard_8.1.7_.4
standard_8.1.7_.1
standard_8.1.7_.0.0
standard_8.1.7
standard_8.1.6
standard_8.1.5
standard_8.0.6_.3
standard_8.0.6
enterprise_8.1.7_.4
enterprise_8.1.7_.1.0
enterprise_8.1.7_.0.0
enterprise_8.1.6_.1.0
enterprise_8.1.6_.0.0
enterprise_8.1.5_.1.0
enterprise_8.1.5_.0.2
enterprise_8.1.5_.0.0
enterprise_8.0.6_.0.1
enterprise_8.0.6_.0.0
enterprise_8.0.5_.0.0
Product: Collaboration suite 
Version: release_1;
Product: Application server 
Version:
9.0.4.1
9.0.4.0
9.0.4
9.0.3.1
9.0.3
9.0.2.3
9.0.2.2
9.0.2.1
9.0.2.0.1
9.0.2.0.0
9.0.2
Product: Enterprise manager 
Version: 9.0.1; 9;
Product: E-business suite 
Version:
11.5.9
11.5.8
11.5.7
11.5.6
11.5.5
11.5.4
11.5.3
11.5.2
11.5.1
Product: Enterprise manager database control 
Version: 10.1.2;
Product: Enterprise manager grid control 
Version: 10.1.0.2;

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.8/10
6.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
None
None

 References:
http://www.us-cert.gov/cas/techalerts/TA04-245A.html
http://www.kb.cert.org/vuls/id/435974
http://xforce.iss.net/xforce/xfdb/18656
http://www.securityfocus.com/bid/10871
http://www.ngssoftware.com/advisories/oracle23122004E.txt
http://marc.theaimsgroup.com/?l=bugtraq&m=110382264415387&w=2
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1

Related CVE
CVE-2019-2729
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated at...
CVE-2019-2726
Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Services Integration). The supported version that is affected is 12.3.3. Difficult to exploit vulnerability allows low privileged ...
CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with ...
CVE-2019-2723
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2722
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2721
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2720
Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: ODI Tools). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows low privileged attacker with ne...
CVE-2019-2719
Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications (InfoCenter)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily exploitable vulnerability allows unauthenticated a...

Copyright 2019, cxsecurity.com

 

Back to Top