CVE-2001-1041: Low severity Oracle Database Server vulnerability

Published Aug 31, 2001

Updated

oracle program in Oracle 8.0.x, 8.1.x and 9.0.1 allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (.trc) file that is created in an alternate home directory identified by the ORACLEHOME environment variable.

Affected Software

3 affected components

Oracle Database Server=8.0

Oracle Database Server=8.1

Oracle Database Server=9.0.1

Remediation

Patch Available

http://www.securityfocus.com/bid/3135

Event History

Aug 31, 2001

CVE Published

04:00 AM

Feb 2, 2002

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1041?

CVE-2001-1041 has been classified as a high severity vulnerability due to the potential for local users to overwrite arbitrary files.

How do I fix CVE-2001-1041?

To fix CVE-2001-1041, ensure that the Oracle log trace files are protected and that the ORACLE_HOME environment variable is correctly set to a secure directory.

Who is affected by CVE-2001-1041?

CVE-2001-1041 affects users of Oracle Database versions 8.0.x, 8.1.x, and 9.0.1.

What is a symlink attack in relation to CVE-2001-1041?

A symlink attack in relation to CVE-2001-1041 allows local users to create malicious symbolic links to overwrite sensitive files when the Oracle program creates log trace files.

Can CVE-2001-1041 be exploited remotely?

No, CVE-2001-1041 can only be exploited by local users who have access to the same host.