CVE-2008-2595 Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors. NOTE: the previous infor...
MediumCVSS 5.0
EPSS 11.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a denial of service (crash) via a malformed LDAP request that triggers a NULL pointer dereference.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle database 10g | = 10.1.2.3 | No fix listed |
| oracle database 10g | = 10.1.4.2 | No fix listed |
| oracle database 9i | = 9.0.4.3 | No fix listed |
References
- SSRT061201 vendor-advisory
- 20080715 Oracle Internet Directory Pre-Authentication LDAP DoS Vulnerability third-party-advisory
- 31087 third-party-advisory
- 31113 third-party-advisory
- www.oracle.com
- 1020494 vdb-entry
- ADV-2008-2109 vdb-entry
- ADV-2008-2115 vdb-entry
- 6101 exploit