CVE-2007-3854: Buffer Overflow

Published Jul 18, 2007

Updated

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMSPRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.

Affected Software

38 affected components

Oracle APEX=1.5.0

Oracle APEX=1.6.1

Oracle APEX=2.0

Oracle APEX=2.2

Oracle Application Server=1.0.2.2-r2

Oracle Application Server=9.0.4.3

Oracle Application Server=10.1.2.0.1

Oracle Application Server=10.1.2.0.2

Oracle Application Server=10.1.2.1.0

Oracle Application Server=10.1.2.2.0

Oracle Application Server=10.1.3.0.0

Oracle Application Server=10.1.3.1.0

Oracle Application Server=10.1.3.2.0

Oracle Application Server=10.1.3.3.0

Oracle Collaboration Suite=10.1.2

Oracle Database Server=9.0.1.5

Oracle Database Server=9.2.0.7-r2

Oracle Database Server=9.2.0.8-r2

Oracle Database Server=9.2.0.8dv-r2

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.2-r2

Oracle Database Server=10.2.0.3-r2

Oracle E-Business Suite=11.5.8

Oracle E-Business Suite=11.5.9

Oracle E-Business Suite=11.5.10

Oracle E-Business Suite=11.5.10.2

Oracle E-Business Suite=12.0.0

Oracle E-Business Suite=12.0.1

Oracle Peoplesoft Enterprise Customer Relationship Management=8.9

Oracle Peoplesoft Enterprise Customer Relationship Management=9.0

Oracle Peoplesoft Enterprise Human Capital Management=8.9

Oracle Peoplesoft Enterprise Human Capital Management=9.0

Oracle PeopleSoft Enterprise PeopleTools=8.22

Oracle PeopleSoft Enterprise PeopleTools=8.47

Oracle PeopleSoft Enterprise PeopleTools=8.48

Oracle PeopleSoft Enterprise PeopleTools=8.49

Oracle Secure Enterprise Search=10.1.6

Oracle Secure Enterprise Search=10.1.8

Remediation

Patch Available

http://secunia.com/advisories/26114

Event History

Jul 18, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3854?

CVE-2007-3854 is considered to have a high severity due to its potential impact on Oracle Database security.

How do I fix CVE-2007-3854?

To address CVE-2007-3854, apply the latest security patches provided by Oracle for the affected database versions.

What software versions are affected by CVE-2007-3854?

CVE-2007-3854 affects Oracle Database versions 9.0.1.5+, 9.2.0.7, and 10.1.0.5 and related Oracle applications.

Who can exploit the vulnerabilities in CVE-2007-3854?

CVE-2007-3854 can be exploited by remote authenticated users with access to the affected Oracle Database components.

What components are involved in CVE-2007-3854?

CVE-2007-3854 involves vulnerabilities in the SYS.DBMS_PRVTAQIS in the Advanced Queuing component and MDSYS.MD in the Spatial component.