Vulnerability CVE-2009-1010 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1010 (CCN-50035)

Assigned:

2009-04-14

Published:

2009-04-14

Updated:

2016-11-22

Summary:

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1008.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

4.4 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.2 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-1010

Source: OSVDB
Type: Broken Link
53749

Source: CCN
Type: SA34693
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: Permissions Required
34693

Source: CCN
Type: SECTRACK ID: 1022055
Oracle Application Server Bugs Let Remote Users Access and Modify Data and Cause Denial of Service Conditions

Source: CONFIRM
Type: Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21660640

Source: CCN
Type: Oracle Critical Patch Update Advisory - April 2009
Oracle Critical Patch Update Advisory - April 2009

Source: CONFIRM
Type: Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html

Source: CCN
Type: OSVDB ID: 53749
Oracle Outside In Technology Microsoft Office Spreadsheet Record Handling Overflow (2009-1010)

Source: BID
Type: Third Party Advisory, VDB Entry
34461

Source: CCN
Type: BID-34461
Oracle April 2009 Critical Patch Update Multiple Vulnerabilities

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1022055

Source: CERT
Type: Third Party Advisory, US Government Resource
TA09-105A

Source: XF
Type: UNKNOWN
oracle-oit-datastreams-bo(50035)

Source: CCN
Type: PUBLIC ADVISORY: 05.15.09
Multiple Vendor Outside In Spreadsheet Integer Overflow Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:websphere_portal:6.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_portal:6.0.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:oracle:application_server:8.2.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:8.3.0:*:*:*:*:*:*:*

Denotes that component is vulnerable