CVE-2012-1675: High severity Oracle Database Server vulnerability
The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary database commands by performing a remote registration of a database (1) instance or (2) service name that already exists, then conducting a man-in-the-middle (MITM) attack to hijack database connections, aka "TNS Poison."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1675?
CVE-2012-1675 is considered to be a critical vulnerability due to its ability to allow remote attackers to execute arbitrary database commands.
How do I fix CVE-2012-1675?
To fix CVE-2012-1675, it is recommended to apply the latest security patches provided by Oracle for affected versions of the Oracle Database.
What versions of Oracle Database are affected by CVE-2012-1675?
CVE-2012-1675 affects Oracle Database versions 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3, and 11.2.0.4.
Can CVE-2012-1675 be exploited remotely?
Yes, CVE-2012-1675 can be exploited remotely, allowing attackers to execute commands without authentication.
What products besides Oracle Database are affected by CVE-2012-1675?
CVE-2012-1675 may also affect Oracle Fusion Middleware, Oracle Enterprise Manager, Oracle E-Business Suite, and possibly other Oracle products.