Vulnerability CVE-2008-3973 - CERT Civis.Net

Vulnerability Name:

CVE-2008-3973 (CCN-47974)

Assigned:

2008-09-09

Published:

2009-01-13

Updated:

2012-10-23

Summary:

Unspecified vulnerability in the SQL*Plus Windows GUI component in Oracle Database allows local users to affect confidentiality via unknown vectors.

CVSS v3 Severity:

2.8 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

1.7 Low (CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N)
1.3 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N)
1.3 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2008-3973

Source: OSVDB
Type: UNKNOWN
51351

Source: CCN
Type: SA33525
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
33525

Source: CCN
Type: SECTRACK ID: 1021561
Oracle Database Lets Remote Authenticated Users Access and Modify Data and Cause Denial of Service Conditions

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - January 2009

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html

Source: CCN
Type: OSVDB ID: 51351
Oracle Database SQL*Plus Windows GUI Unspecified Remote Information Disclosure (2008-3973)

Source: BID
Type: UNKNOWN
33177

Source: CCN
Type: BID-33177
Oracle January 2009 Critical Patch Update Multiple Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1021561

Source: VUPEN
Type: UNKNOWN
ADV-2009-0115

Source: XF
Type: UNKNOWN
oracle-database-sqlplus-info-disclosure2(47974)

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_10g:10.1.2.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_10g:10.1.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_10g:10.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_10g:10.2.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_11g:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.8:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.3:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.8dv:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:11.1.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*

Denotes that component is vulnerable