Vulnerability Name:

CVE-2008-7233 (CCN-53640)

Assigned:2008-01-15
Published:2008-01-15
Updated:2012-10-23
Summary:Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Oracle Jinitiator component, aka AS02.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-7233

Source: HP
Type: UNKNOWN
SSRT061201

Source: CCN
Type: SA28518
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
28518

Source: CCN
Type: SA28556
HP Oracle for OpenView Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
28556

Source: CCN
Type: SECTRACK ID: 1019218
Oracle Database and Other Products Have Unspecified Vulnerabilities With Unspecified Impact

Source: SECTRACK
Type: UNKNOWN
1019218

Source: CCN
Type: Oracle Critical Patch Update - January 2008
Oracle Critical Patch Update Advisory - January 2008

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujan2008-086860.html

Source: OSVDB
Type: UNKNOWN
40294

Source: CCN
Type: OSVDB ID: 40294
Oracle Application Server Jinitiator Unspecified Remote Issue (AS02)

Source: BID
Type: Exploit
27229

Source: CCN
Type: BID-27229
Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

Source: CERT
Type: Patch, US Government Resource
TA08-017A

Source: VUPEN
Type: Vendor Advisory
ADV-2008-0150

Source: VUPEN
Type: Vendor Advisory
ADV-2008-0180

Source: XF
Type: UNKNOWN
ebusiness-jinitiator-unspecified(53640)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:application_server:1.1.8.26:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite_11i:11.5.10.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:e-business_suite_11i:11.5.10.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:1.1.8.26:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle application server 1.1.8.26
    oracle e-business suite 11i 11.5.10.2
    oracle e-business suite 11i 11.5.10.2
    oracle application server 1.1.8.26