CVE

Id
13577  
CVE No.
CVE-2005-2371  
Status
Candidate  
Description
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case it overlaps CVE-2006-0289.  
Phase
Assigned (20050726)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
98429 13577 CVE-2005-2371 BUGTRAQ:20050719 Oracle Security Advisory: Overwrite any file via desname in Oracle Reports  View
98430 13577 CVE-2005-2371 URL:http://marc.info/?l=bugtraq&m=112180096507467&w=2  View
98431 13577 CVE-2005-2371 BUGTRAQ:20060117 Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)  View
98432 13577 CVE-2005-2371 URL:http://www.securityfocus.com/archive/1/archive/1/422257/30/7430/threaded  View
98433 13577 CVE-2005-2371 MISC:http://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.html  View
98434 13577 CVE-2005-2371 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html  View
98435 13577 CVE-2005-2371 BID:14309  View
98436 13577 CVE-2005-2371 URL:http://www.securityfocus.com/bid/14309  View
98437 13577 CVE-2005-2371 VUPEN:ADV-2006-0323  View
98438 13577 CVE-2005-2371 URL:http://www.vupen.com/english/advisories/2006/0323  View
98439 13577 CVE-2005-2371 SECTRACK:1014524  View
98440 13577 CVE-2005-2371 URL:http://securitytracker.com/id?1014524  View
98441 13577 CVE-2005-2371 SECUNIA:18493  View
98442 13577 CVE-2005-2371 URL:http://secunia.com/advisories/18493  View
98443 13577 CVE-2005-2371 SECUNIA:18608  View
98444 13577 CVE-2005-2371 URL:http://secunia.com/advisories/18608  View
98445 13577 CVE-2005-2371 XF:oracle-january2006-update(24321)  View

Related JVN