CVE-2015-0393: Medium severity oracle e-business suite vulnerability

Published Jan 21, 2015

Updated

Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that the PUBLIC role is granted the INDEX privilege for the DUAL table during a "seeded install," which allows remote authenticated users to gain SYSDBA privileges and execute arbitrary code.

Affected Software

6 affected components

Oracle E-Business Suite=11.5.10.2

Oracle E-Business Suite=12.0.6

Oracle E-Business Suite=12.1.3

Oracle E-Business Suite=12.2.2

Oracle E-Business Suite=12.2.3

Oracle E-Business Suite=12.2.4

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Event History

Jan 21, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0393?

CVE-2015-0393 is considered a significant vulnerability that can affect confidentiality, integrity, and availability in Oracle E-Business Suite.

How do I fix CVE-2015-0393?

To fix CVE-2015-0393, it is recommended to apply the latest patches provided by Oracle for the specific version of E-Business Suite in use.

Who is affected by CVE-2015-0393?

CVE-2015-0393 affects remote authenticated users with certain DB privileges in Oracle E-Business Suite versions 11.5.10.2 and 12.0.6 through 12.2.4.

What are the potential impacts of CVE-2015-0393?

The potential impacts of CVE-2015-0393 include unauthorized access leading to data compromise and disruptions in system availability.

When was CVE-2015-0393 disclosed?

CVE-2015-0393 was disclosed in January 2015 during Oracle's Critical Patch Update.