Vulnerability CVE-2004-1707


Published: 2004-07-30   Modified: 2012-02-12

Description:
The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0.

Vendor: Oracle
Product: Oracle9i 
Version:
standard_9.2.3
standard_9.2.0.4
standard_9.2.0.3
standard_9.2.0.2
standard_9.2.0.1
standard_9.2
standard_9.0.2
standard_9.0.1.5
standard_9.0.1.4
standard_9.0.1.3
standard_9.0.1.2
standard_9.0.1
standard_9.0
personal_9.2.0.4
personal_9.2.0.3
personal_9.2.0.2
personal_9.2.0.1
personal_9.2
personal_9.0.1.5
personal_9.0.1.4
personal_9.0.1
personal_8.1.7
enterprise_9.2.0.4
enterprise_9.2.0.3
enterprise_9.2.0.2
enterprise_9.2.0.1
enterprise_9.2.0
enterprise_9.0.1.5
enterprise_9.0.1.4
enterprise_9.0.1
client_9.2.0.2
client_9.2.0.1
Product: Oracle8i 
Version:
standard_8.1.7_.4
standard_8.1.7_.1
standard_8.1.7_.0.0
standard_8.1.7
standard_8.1.6
standard_8.1.5
standard_8.0.6_.3
standard_8.0.6
enterprise_8.1.7_.1.0
enterprise_8.1.7_.0.0
enterprise_8.1.6_.1.0
enterprise_8.1.6_.0.0
enterprise_8.1.5_.1.0
enterprise_8.1.5_.0.2
enterprise_8.1.5_.0.0
enterprise_8.0.6_.0.1
enterprise_8.0.6_.0.0
enterprise_8.0.5_.0.0
Product: Application server 
Version:
9.0.3.1
9.0.3
9.0.2.3
9.0.2.2
9.0.2.1
9.0.2.0.1
9.0.2.0.0
9.0.2
1.0.2.2.2
1.0.2.2
1.0.2.1s
1.0.2
Product: Application server portal 
Version:
9.0.2.3b
9.0.2.3a
9.0.2.3
3.0.9.8.5
Product: Database server lite 
Version:
5.0.2
5.0.1
5.0

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.2/10
10/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://secunia.com/advisories/12205
http://marc.theaimsgroup.com/?l=bugtraq&m=109147677214087&w=2
http://xforce.iss.net/xforce/xfdb/16839
http://www.securityfocus.com/bid/10829

Related CVE
CVE-2019-2726
Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Services Integration). The supported version that is affected is 12.3.3. Difficult to exploit vulnerability allows low privileged ...
CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with ...
CVE-2019-2723
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2722
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2721
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon...
CVE-2019-2720
Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: ODI Tools). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows low privileged attacker with ne...
CVE-2019-2719
Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications (InfoCenter)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily exploitable vulnerability allows unauthenticated a...
CVE-2019-2713
Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access vi...

Copyright 2019, cxsecurity.com

 

Back to Top