CVE-2010-4416

Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party researcher that this is a buffer overflow via a crafted XML soap request and a value that does not contain the expected 0x20 terminator character.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/42979	Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html	Vendor Advisory
http://www.securityfocus.com/bid/45868
http://www.securitytracker.com/id?1024981
http://www.vupen.com/english/advisories/2011/0143	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-11-019/
https://exchange.xforce.ibmcloud.com/vulnerabilities/64775

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:fusion_middleware:3.0.0.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2011-01-19 16:00

Updated : 2017-08-17 01:33

NVD link : CVE-2010-4416

Mitre link : CVE-2010-4416

CVE.ORG link : CVE-2010-4416

JSON object : View

Products Affected

oracle

fusion_middleware

CWE

NVD-CWE-noinfo

{"id": "CVE-2010-4416", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-01-19T16:00:03.170", "references": [{"url": "http://secunia.com/advisories/42979", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securityfocus.com/bid/45868", "source": "secalert_us@oracle.com"}, {"url": "http://www.securitytracker.com/id?1024981", "source": "secalert_us@oracle.com"}, {"url": "http://www.vupen.com/english/advisories/2011/0143", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-11-019/", "source": "secalert_us@oracle.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64775", "source": "secalert_us@oracle.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party researcher that this is a buffer overflow via a crafted XML soap request and a value that does not contain the expected 0x20 terminator character."}, {"lang": "es", "value": "Una vulnerabilidad no especificada en el componente Oracle GoldenGate Veridata en Fusion Middleware de Oracle versi\u00f3n 3.0.0.4, permite a los atacantes remotos afectar la disponibilidad por medio de vectores desconocidos relacionados con Server. NOTA: la informaci\u00f3n anterior fue obtenida de la CPU de enero de 2011. Oracle no ha comentado las afirmaciones de un investigador de terceros confiable de que se trata de un desbordamiento de b\u00fafer por medio de una petici\u00f3n SOAP XML especialmente dise\u00f1ada y un valor que no contiene el car\u00e1cter de terminador 0x20 previsto."}], "lastModified": "2017-08-17T01:33:10.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:fusion_middleware:3.0.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49E204E4-543B-4708-B0AE-A8A0665FA474"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}