CVE-1999-0711: Medium severity oracle oracle8i vulnerability
The oratclsh interpreter in Oracle 8.x Intelligent Agent for Unix allows local users to execute Tcl commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
oracle/intelligent-agent/oratclshfrom your environment.Uninstall or remove the oratclsh interpreter or the Oracle Intelligent Agent component from affected Unix systems if it is not required.
- Configuration
Restrict execution of the oratclsh binary to the root user only (for example: chown root:root /path/to/oratclsh and chmod 700 /path/to/oratclsh) to prevent local non-root users from running it.
oratclsh (Oracle Intelligent Agent) file_permissions = root-only execute - Configuration
Disable the Oracle Intelligent Agent service on Unix hosts where the agent is not required to prevent invocation of oratclsh.
Oracle Intelligent Agent (Unix) service_enabled = disabled - Compensating control
Limit and harden local user accounts and access on affected hosts (ensure only trusted administrative accounts have shell access), and apply host-based access controls to reduce the risk of local users exploiting the oratclsh interpreter.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0711?
CVE-1999-0711 is considered a critical vulnerability as it allows local users to execute Tcl commands with root privileges.
How do I fix CVE-1999-0711?
To fix CVE-1999-0711, upgrade to a version of Oracle 8i that is not affected, specifically versions after 8.1.5.
What software does CVE-1999-0711 affect?
CVE-1999-0711 affects multiple versions of Oracle 8i, including 8.0.3, 8.0.4, 8.0.5, 8.0.5.1, and 8.1.5.
Who can exploit CVE-1999-0711?
CVE-1999-0711 can be exploited by local users with access to the oratclsh interpreter on affected Oracle 8i installations.
What are the potential impacts of CVE-1999-0711?
The potential impacts of CVE-1999-0711 include unauthorized access to system privileges leading to full control over the Oracle database on affected systems.