CVE-2007-1442 - Oracle Database 10g uses a NULL pDacl parameter when calling the SetSecurityDescriptorDacl function

CVE-2007-1442

Summary

Oracle Database 10g uses a NULL pDacl parameter when calling the SetSecurityDescriptorDacl function to create discretionary access control lists (DACLs), which allows local users to gain privileges.

References

Vulnerable Configurations

cpe:2.3:a:oracle:database_server:10.2.1:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.1:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.1:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.1:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.1:*:standard:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.1:*:standard:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:standard:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.2:*:standard:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:enterprise:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:personal:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:standard:*:*:*:*:*
cpe:2.3:a:oracle:database_server:10.2.3:*:standard:*:*:*:*:*

CVSS

Base:	7.2 (as of 15-11-2008 - 06:44)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	22905
misc	http://argeniss.com/research/10MinSecAudit.zip
osvdb	33979
secunia	24475

Last major update

15-11-2008 - 06:44

Published

14-03-2007 - 00:19

Last modified

15-11-2008 - 06:44