search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Oracle products contain multiple vulnerabilities

Vulnerability Note VU#948486

Original Release Date: 2005-04-27 | Last Revised: 2005-04-28

Overview

Multiple vulnerabilities exist in numerous Oracle products. The impacts of these vulnerabilities are varied and may include remote execution of arbitrary code, the diclosure of sensitive information, and denial-of-service conditions.

Description

Multiple vulnerabilities exist in numerous Oracle products including:

    • Oracle Database Server
    • Oracle Application Server
    • Oracle Collaboration Suite
    • Oracle E-Business Suite
    • Oracle Enterprise Manager Grid Control
    • Oracle PeopleSoft Applications

According to public reports, many of the vulnerabilities that affect the Oracle HTTP Server, which is strongly based on Apache HTTP Server, have been publicly known for some time.

For more details concerning vulnerabilities and the conditions necessary to exploit them, please refer to the Oracle Critical Patch Update for April 2005.

Impact

The complete impact of these issues vary depending on the particular application and vulnerability being attacked. Potential consequences may include the remote execution of arbitrary code, disclosure of sensitive information, and denial-of-service conditions. Database compromises may result in the diclosure of sensitive personal information, such as credit card numbers, social security numbers, and health and patient information.

Solution

Apply Patch


Apply the appropriate patch or upgrade as specified in the Oracle Critical Patch Update for April 2005.

Vendor Information

948486
 
Expand all

Oracle Corporation Affected

Updated:  April 26, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see the Oracle Critcal Patch Update for April 2005.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Alexander Kornbrust of Red Database Security for helping us with these issues. This document is based on information contained in the Oracle Critical Patch Update for April 2005. Oracle credits NGS Software Ltd., Integrigy, and Application Security, Inc.

This document was written by Jeff Gennari.

Other Information

CVE IDs: None
Severity Metric: 55.60
Date Public: 2005-04-12
Date First Published: 2005-04-27
Date Last Updated: 2005-04-28 13:54 UTC
Document Revision: 86

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis