CVE-2007-4467: Input Validation
First published: Fri Aug 31 2007(Updated: )
Multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control (beans.ocx) 1.1.8.16 and earlier, as used by Oracle Forms applications from Oracle and third parties, allow remote attackers to execute arbitrary code via unspecified "initialization parameters." NOTE: it was later reported that 1.1.8.3 through 1.1.8.25, and probably 1.1.5.x and 1.1.7.x, are affected.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JInitiator | =1.1.8.16 | |
| Oracle JInitiator | =1.1.5 | |
| Oracle JInitiator | =1.1.8.3 | |
| Oracle JInitiator | =1.1.8.25 | |
| Oracle JInitiator | =1.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.kb.cert.org/vuls/id/474433
- http://www.securityfocus.com/bid/25473
- http://securitytracker.com/id?1018618
- http://secunia.com/advisories/26644
- http://www.integrigy.com/security-resources/analysis/integrigy-oracle-jinitiator-vulnerability.pdf
- http://osvdb.org/37711
- http://www.vupen.com/english/advisories/2007/3007
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36310
- http://www.securityfocus.com/archive/1/479186/100/100/threaded
Frequently Asked Questions
What is the severity of CVE-2007-4467?
CVE-2007-4467 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-4467?
To mitigate CVE-2007-4467, users should upgrade to a patched version of Oracle JInitiator.
What versions of Oracle JInitiator are affected by CVE-2007-4467?
CVE-2007-4467 affects Oracle JInitiator versions 1.1.5, 1.1.7, 1.1.8.3, 1.1.8.16, and 1.1.8.25.
Can CVE-2007-4467 be exploited remotely?
Yes, CVE-2007-4467 can be exploited remotely by attackers to execute arbitrary code on vulnerable systems.
What should I do if I cannot upgrade Oracle JInitiator for CVE-2007-4467?
If unable to upgrade, consider implementing additional security controls to restrict access to the affected application.
- collector/nvd-historical
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- agent/source
- vendor/oracle
- canonical/oracle jinitiator
- version/oracle jinitiator/1.1.8.16
- version/oracle jinitiator/1.1.5
- version/oracle jinitiator/1.1.8.3
- version/oracle jinitiator/1.1.8.25
- version/oracle jinitiator/1.1.7