1. CVE-Search
  2. CVE-2007-3855
ID CVE-2007-3855
Summary Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17). NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database_server:9.2.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:9.2.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database_server:9.2.0.8dv:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:9.2.0.8dv:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 15-10-2018 - 21:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bugtraq
  • 20070718 Oracle Security: Insert / Update / Delete Data via Views
  • 20070721 Oracle bad Views - Exploit released
cert TA07-200A
confirm http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
hp
  • HPSBMA02133
  • SSRT061201
misc
sectrack 1018415
secunia
  • 26114
  • 26166
sreason 2903
vupen
  • ADV-2007-2562
  • ADV-2007-2635
xf
  • oracle-cpu-july2007(35490)
  • oracle-unauth-view-access(35495)
Last major update 15-10-2018 - 21:31
Published 18-07-2007 - 19:30
Last modified 15-10-2018 - 21:31
Back to Top