SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#809457

Oracle Database vulnerable to privilege escalation

Overview

A vulnerability in Oracle Database for Microsoft Windows could allow a remote attacker to log on to the system with elevated privileges.

I. Description

A vulnerability exists in Oracle Database's Core Relational Database Management System (RDBMS) that may allow a remote attacker to log on to the system with elevated privileges. According to NGSSoftware-OracleCPUAPR2007:

    Due to the way that Windows XP with Simple File Sharing enabled logs on users it is possible for an attacker to gain DBA access to the Oracle server.


Note that this issue affects Oracle Database versions including 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 installed in Microsoft Windows.

II. Impact

A remote attacker could log on to a vulnerable system and gain elevated privileges.

III. Solution

Apply a patch
See the Oracle Critical Patch Update - April 2007 for information about obtaining upgrades.


Disable simple file sharing

Disabling simple file sharing may mitigate this vulnerability. See Microsoft Knowledgebase Article 307874 for more details.

Systems Affected

VendorStatusDate NotifiedDate Updated
Oracle CorporationVulnerable18-Apr-2007

References


http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html
http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf
http://www.ngssoftware.com/papers/database-on-xp.pdf
http://support.microsoft.com/kb/307874

Credit

This issue is addressed in Oracle Critical Patch Update - April 2007.

This document was written by Chris Taschner.

Other Information

Date Public:2007-04-17
Date First Published:2007-04-18
Date Last Updated:2007-04-24
CERT Advisory: 
CVE-ID(s): 
NVD-ID(s): 
US-CERT Technical Alerts: 
Metric:8.27
Document Revision:26

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader