CVE Vulnerability

CVE-2007-5561

Format string vulnerability in the logging function in the Oracle OPMN daemon, as used on Oracle Enterprise Grid Console server 10.2.0.1, allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP request to port 6003, aka Oracle reference number 6296175. NOTE: this might be the same issue as CVE-2007-0282 or CVE-2007-0280, but there are insufficient details to be sure.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://www.irmplc.com/index.php/111-Vendor-Alerts
http://www.irmplc.com/index.php/142-Advisory-021 Exploit Patch
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
Configurations

Configuration 1

cpe:2.3:a:oracle:enterprise_grid_console_server:10.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:opmn_daemon:*:*:*:*:*:*:*:*
Information

Published : 2007-10-18 08:17

Updated : 2008-09-05 09:31

NVD link : CVE-2007-5561

Mitre link : CVE-2007-5561

Products Affected
No products.
CWE
CWE-134

Use of Externally-Controlled Format String