CVE-2004-1365

3 documents3 sources

Severity

4.6MEDIUM

EPSS

0.3%

top 44.08%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle Application Server Oracle Collaboration Suite Oracle E-business Suite +6 more

Timeline

PublishedAug 4

Latest updateApr 29

Description

Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages9 packages

▶NVDoracle/oracle8i19 versions+18

▶NVDoracle/oracle9i36 versions+35

▶NVDoracle/oracle10g6 versions+5

▶NVDoracle/e-business_suite9 versions+8

▶NVDoracle/application_server11 versions+10

Patches

Patch: www.ngssoftware.com ↗Patch: www.securityfocus.com ↗Patch: www.us-cert.gov ↗

🔴Vulnerability Details

GHSA

GHSA-c547-5m3r-v2p8: Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary co↗2022-04-29

▶

CVEList

CVE-2004-1365: Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary co↗2005-01-19

▶