Vulnerability in Microsoft Windows
CVE-2007-2108
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI AcceptSecurityContext function grants privileges based on the username provided even though all users are authenticated as Guest, which allows remote attackers to gain privileges.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.215 (97.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.215 · newest: 0.215 · change: 0.000
Affected products
- Microsoft Windows
- Oracle Database Server — versions 9.0.1.5, 9.2.0.8, 10.1.0.5
Weakness classification (CWE)
References
- www.ngssoftware.com/papers/database-on-xp.pdf
- www.us-cert.gov/cas/techalerts/TA07-108A.html (US Government Resource, third-party-advisory)
- www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
- www.kb.cert.org/vuls/id/809457 (US Government Resource, third-party-advisory)
- www.securityfocus.com/bid/23532 (vdb-entry)
- www.securitytracker.com/id (vdb-entry)
- www.securityfocus.com/archive/1/466329/100/200/threaded (vendor-advisory)
- www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
- www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf
- www.vupen.com/english/advisories/2007/1426 (vdb-entry, Vendor Advisory)