Vulnerability CVE-2007-2110 - CERT Civis.Net

Vulnerability Name:

CVE-2007-2110 (CCN-33809)

Assigned:

2007-04-17

Published:

2007-04-17

Updated:

2018-10-16

Summary:

Unspecified vulnerability in the Core RDBMS component for Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.4 on Windows systems has unknown impact and attack vectors, aka DB03.
Note: as of 20070424, Oracle has not disputed reliable claims that DB03 occurs because RDBMS uses a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections, which allows local users to inject threads and execute arbitrary code via the OpenProcess, OpenThread, and SetThreadContext functions (DB03).

CVSS v3 Severity:

4.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.4 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.4 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Informational

References:

Source: CCN
Type: Full-Disclosure Mailing List, Wed Apr 18 2007 - 11:07:27 CDT
Oracle E-Business Suite Vulnerability Information April 2007

Source: MITRE
Type: CNA
CVE-2007-2108

Source: MITRE
Type: CNA
CVE-2007-2109

Source: MITRE
Type: CNA
CVE-2007-2110

Source: MITRE
Type: CNA
CVE-2007-2111

Source: MITRE
Type: CNA
CVE-2007-2112

Source: MITRE
Type: CNA
CVE-2007-2113

Source: MITRE
Type: CNA
CVE-2007-2114

Source: MITRE
Type: CNA
CVE-2007-2115

Source: MITRE
Type: CNA
CVE-2007-2116

Source: MITRE
Type: CNA
CVE-2007-2117

Source: MITRE
Type: CNA
CVE-2007-2118

Source: MITRE
Type: CNA
CVE-2007-2119

Source: MITRE
Type: CNA
CVE-2007-2120

Source: MITRE
Type: CNA
CVE-2007-2121

Source: MITRE
Type: CNA
CVE-2007-2122

Source: MITRE
Type: CNA
CVE-2007-2123

Source: MITRE
Type: CNA
CVE-2007-2124

Source: MITRE
Type: CNA
CVE-2007-2125

Source: MITRE
Type: CNA
CVE-2007-2126

Source: MITRE
Type: CNA
CVE-2007-2127

Source: MITRE
Type: CNA
CVE-2007-2128

Source: MITRE
Type: CNA
CVE-2007-2129

Source: MITRE
Type: CNA
CVE-2007-2130

Source: MITRE
Type: CNA
CVE-2007-2131

Source: MITRE
Type: CNA
CVE-2007-2132

Source: MITRE
Type: CNA
CVE-2007-2133

Source: MITRE
Type: CNA
CVE-2007-2134

Source: MITRE
Type: CNA
CVE-2007-2135

Source: MITRE
Type: CNA
CVE-2007-2170

Source: CCN
Type: IBM Security Bulletin 1268889
Oracle Engine Upgrade and Critical Patch - TCIM 6.0/7.0/8.0 Embedded Database Engine Upgrade (10.1.0.5) and April 2007 Oracle Critical Path Update

Source: MLIST
Type: UNKNOWN
[oracle-l] 20061201 Re: Oracle 9i on Windows 2003 -- Vulnerability Question

Source: MISC
Type: UNKNOWN
http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf

Source: CCN
Type: US-CERT VU#809457
Oracle Database vulnerable to privilege escalation

Source: MISC
Type: UNKNOWN
http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf

Source: CCN
Type: Oracle Critical Patch Update - April 2007
Oracle Critical Patch Update Advisory - April 2007

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html

Source: CCN
Type: OSVDB ID: 39920
Oracle PeopleSoft Enterprise Human Capital Management Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 39921
Oracle PeopleSoft JD Edwards HTTP Server Browser Cache Login Credential Disclosure

Source: CCN
Type: OSVDB ID: 39922
Oracle PeopleSoft PeopleTools Unspecified FTP Script Upload Issue

Source: CCN
Type: OSVDB ID: 39923
Oracle PeopleSoft PeopleTools Unspecified Stored XSS

Source: CCN
Type: OSVDB ID: 39924
Oracle Database Core RDBMS NTLM SSPI AcceptSecurityContext Function Remote Privilege Escalation

Source: CCN
Type: OSVDB ID: 39925
Oracle Database Rules Manager Expression Filter RLMGR_TRUNCATE_MAINT Trigger Race Condition

Source: CCN
Type: OSVDB ID: 39926
Oracle Database Core RDBMS NULL DACL Multiple Function Arbitrary Code Execution

Source: CCN
Type: OSVDB ID: 39929
Oracle Database Streams DBMS_APPLY_USER_AGENT.SET_REGISTRATION_HANDLER Procedure SQL Injection

Source: CCN
Type: OSVDB ID: 39931
Oracle Database Change Data Capture (CDC) DBMS_CDC_IPUBLISH.CHGTAB_CACHE CHANGE_TABLE_NAME Parameter Remote Overflow

Source: CCN
Type: OSVDB ID: 39932
Oracle Database Change Data Capture (CDC) DBMS_CDC_PUBLISH Multiple SQL Injections

Source: CCN
Type: OSVDB ID: 39934
Oracle Database Instant Client genezi Command Unspecified Local Issue

Source: CCN
Type: OSVDB ID: 39935
Oracle Database Text ctxsrv Command Unspecified Local Issue

Source: CCN
Type: OSVDB ID: 39936
Oracle Database Upgrade/Downgrade mig Command Local Overflow

Source: CCN
Type: OSVDB ID: 39939
Oracle Database Agent Unauthenticated Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39940
Oracle Collaboration Suite Workspace Unspecified Authenticated Issue (OCS01)

Source: CCN
Type: OSVDB ID: 39942
Oracle Application Server COREid Access HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39943
Oracle Application Server Wireless HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39944
Oracle Application Server Portal HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39945
Oracle Application Server Portal HTTP Unspecified Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39948
Oracle E-Business Suite Report Manager Unauthenticated Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39949
Oracle E-Business Suite Application Object Library Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39950
Oracle E-Business Suite iStore Unspecified Remote Information Disclosure (APPS05)

Source: CCN
Type: OSVDB ID: 39951
Oracle E-Business Suite iStore Unspecified Remote Information Disclosure (APPS06)

Source: CCN
Type: OSVDB ID: 39952
Oracle E-Business Suite iSupport Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39953
Oracle E-Business Suite Sales Online Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39954
Oracle E-Business Suite Trade Management Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39955
Oracle E-Business Suite Applications Manager Patch Administrator Local Information Disclosure

Source: CCN
Type: Red-Database-Security Web site
Details Oracle Critical Patch Update April 2007

Source: MISC
Type: UNKNOWN
http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html

Source: HP
Type: UNKNOWN
SSRT061201

Source: BID
Type: UNKNOWN
23532

Source: SECTRACK
Type: UNKNOWN
1017927

Source: CERT
Type: US Government Resource
TA07-108A

Source: VUPEN
Type: Vendor Advisory
ADV-2007-1426

Source: XF
Type: UNKNOWN
oracle-cpu-april2007(33809)

Source: CCN
Type: IBM Internet Security Systems X-Force Database
Oracle E-Business Suite APPLSYS.FND_DM_NODES node deletion

Source: MISC
Type: UNKNOWN
https://www.blackhat.com/presentations/bh-dc-07/Cerrudo/Presentation/bh-dc-07-Cerrudo-ppt.pdf

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.4:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.1:r2:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.1:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:10.1.2:r1:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterpriseone:8.96:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.22:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.47:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.8:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.3:r2:*:*:*:*:*:*

OR cpe:/a:oracle:secure_enterprise_search:10.1.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_manager:9.2.0.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_manager:9.2.0.8:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_human_capital_management:8.9:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.1.5::fips+:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*

Denotes that component is vulnerable