Vulnerability Name:

CVE-2007-3854 (CCN-35497)

Assigned:2007-07-17
Published:2007-07-17
Updated:2017-07-29
Summary:Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12).
Note: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
CVSS v3 Severity:5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
5.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Informational
References:Source: MITRE
Type: CNA
CVE-2007-3854

Source: CCN
Type: HP Security Bulletin HPSBMA02133 SSRT061201 rev.5
HP Oracle for OpenView (OfO) Critical Patch Update

Source: HP
Type: UNKNOWN
SSRT061201

Source: CCN
Type: SA26114
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
26114

Source: CCN
Type: SA26166
HP Oracle for OpenView Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
26166

Source: CCN
Type: SECTRACK ID: 1018415
Oracle Database and Other Products Have Unspecified Vulnerabilities With Unspecified Impact

Source: MISC
Type: UNKNOWN
http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf

Source: CCN
Type: Oracle Critical Patch Update - July 2007
Oracle Critical Patch Update Advisory - July 2007

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html

Source: CCN
Type: Red-Database-Security Web site
Details Oracle Critical Patch Update July 2007 - V1.01

Source: MISC
Type: UNKNOWN
http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html

Source: CCN
Type: Red-Database-Security Advisory 17 July 2007 (V 1.00)
SQL Injection in DBMS_PRVTAQIS [DB02] (fixed in CPUJul2007)

Source: MISC
Type: UNKNOWN
http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html

Source: SECTRACK
Type: UNKNOWN
1018415

Source: CERT
Type: US Government Resource
TA07-200A

Source: VUPEN
Type: Vendor Advisory
ADV-2007-2562

Source: VUPEN
Type: Vendor Advisory
ADV-2007-2635

Source: XF
Type: UNKNOWN
oracle-cpu-july2007(35490)

Source: XF
Type: UNKNOWN
oracle-prvtaqis-sql-injection(35497)

Source: XF
Type: UNKNOWN
oracle-prvtaqis-sql-injection(35497)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:apex:1.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:apex:1.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:apex:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:apex:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.0.2.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.3.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.3.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.3.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.3.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.0.1.5:*:fips:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.8:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.8dv:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.3:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.10.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:12.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:12.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_customer_relationship_management:8.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_customer_relationship_management:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_human_capital_management:8.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_human_capital_management:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.22:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.47:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.49:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:secure_enterprise_search:10.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:secure_enterprise_search:10.1.8:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.1:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.2:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.22:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.47:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.8:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.3:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:secure_enterprise_search:10.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:12.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_human_capital_management:8.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.0.1.5:*:fips+:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.8dv:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:secure_enterprise_search:10.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:12.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.49:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_human_capital_management:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_customer_relationship_management:8.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_customer_relationship_management:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:http_server:9.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle apex 1.5.0
    oracle apex 1.6.1
    oracle apex 2.0
    oracle apex 2.2
    oracle application server 1.0.2.2 r2
    oracle application server 9.0.4.3
    oracle application server 10.1.2.0.1
    oracle application server 10.1.2.0.2
    oracle application server 10.1.2.1.0
    oracle application server 10.1.2.2.0
    oracle application server 10.1.3.0.0
    oracle application server 10.1.3.1.0
    oracle application server 10.1.3.2.0
    oracle application server 10.1.3.3.0
    oracle collaboration suite 10.1.2
    oracle database server 9.0.1.5
    oracle database server 9.2.0.7 r2
    oracle database server 9.2.0.8 r2
    oracle database server 9.2.0.8dv r2
    oracle database server 10.1.0.5
    oracle database server 10.2.0.2 r2
    oracle database server 10.2.0.3 r2
    oracle e-business suite 11.5.8
    oracle e-business suite 11.5.9
    oracle e-business suite 11.5.10
    oracle e-business suite 11.5.10.2
    oracle e-business suite 12.0.0
    oracle e-business suite 12.0.1
    oracle peoplesoft enterprise customer relationship management 8.9
    oracle peoplesoft enterprise customer relationship management 9.0
    oracle peoplesoft enterprise human capital management 8.9
    oracle peoplesoft enterprise human capital management 9.0
    oracle peoplesoft enterprise peopletools 8.22
    oracle peoplesoft enterprise peopletools 8.47
    oracle peoplesoft enterprise peopletools 8.48
    oracle peoplesoft enterprise peopletools 8.49
    oracle secure enterprise search 10.1.6
    oracle secure enterprise search 10.1.8
    oracle application server 1.0.2.2
    oracle application server 10.1.2.0.1 r2
    oracle application server 10.1.2.0.2 r2
    oracle database server 10.1.0.5 r1
    oracle database server 9.2.0.7 r2
    oracle collaboration suite 10.1.2 r1
    oracle e-business suite 11.5.10
    oracle database server 10.2.0.2 r2
    oracle application server 9.0.4.3
    oracle peoplesoft enterprise peopletools 8.22
    oracle peoplesoft enterprise peopletools 8.47
    oracle peoplesoft enterprise peopletools 8.48
    oracle database server 9.2.0.8 r2
    oracle database server 10.2.0.3 r2
    oracle secure enterprise search 10.1.6
    oracle e-business suite 12.0.0
    oracle peoplesoft enterprise human capital management 8.9
    oracle database server 9.0.1.5
    oracle database server 9.2.0.8dv r2
    oracle secure enterprise search 10.1.8
    oracle e-business suite 12.0.1
    oracle peoplesoft enterprise peopletools 8.49
    oracle peoplesoft enterprise human capital management 9.0
    oracle peoplesoft enterprise customer relationship management 8.9
    oracle peoplesoft enterprise customer relationship management 9.0
    oracle e-business suite 11.5.8
    oracle e-business suite 11.5.9
    oracle http server 9.2.0