CVE-2007-3854

Description

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.

5.5

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 6.58% Top 10%

Vendor Advisory hp.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory vupen.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143	vendor advisory
http://secunia.com/advisories/26114	third party advisory patch vendor advisory
http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html
http://secunia.com/advisories/26166	third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
http://www.us-cert.gov/cas/techalerts/TA07-200A.html	third party advisory us government resource
http://www.vupen.com/english/advisories/2007/2562	vdb entry vendor advisory
http://www.vupen.com/english/advisories/2007/2635	vdb entry vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/35497	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35490	vdb entry
http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
http://www.securitytracker.com/id?1018415	vdb entry
http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html

Frequently Asked Questions

What is the severity of CVE-2007-3854?: CVE-2007-3854 has been scored as a medium severity vulnerability.
How to fix CVE-2007-3854?: To fix CVE-2007-3854, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-3854 being actively exploited in the wild?: It is possible that CVE-2007-3854 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~7% probability that this vulnerability will be exploited by malicious actors in the next 30 days.