|
|
|
|
| |
Credit:
The information has been provided by Sami Koivu.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-201/
|
| |
Vulnerable Systems:
* Oracle Database Server
Authentication is required in that a user must be able to create a Java stored procedure to trigger the issue.
The specific flaw exists within Oracle's custom SecurityManager implementation. Due to the implementation's dependence on a flag of a particular object to determine success or failure of a privileged call, a race condition exists which will allow one to execute Java code bypassing the sandbox. Successful exploitation will allow an attacker to execute arbitrary code in the context of the server.
Patch Availability:
Oracle has issued an update to correct this vulnerability at:
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE Information:
CVE-2010-2419
Disclosure Timeline:
2010-01-15 - Vulnerability reported to vendor
2010-10-12 - Coordinated public release of advisor
|
|
|
|
|
