CVE-2004-1368

ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.

Score

CVSS 2.0 7.8 High

Status

Modified - cve@mitre.org

Published

2004-08-04

Last modified

2024-08-08

Affected products

• Application Server (Oracle)
• Collaboration Suite (Oracle)
• E-business Suite (Oracle)
• Enterprise Manager (Oracle)
• Enterprise Manager Database Control (Oracle)
• Enterprise Manager Grid Control (Oracle)
• Oracle10g (Oracle)
• Oracle8i (Oracle)
• Oracle9i (Oracle)

References

• http://marc.info/?l=bugtraq&m=110382264415387&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
• http://www.kb.cert.org/vuls/id/435974
• http://www.ngssoftware.com/advisories/oracle23122004E.txt
• http://www.securityfocus.com/bid/10871
• http://www.us-cert.gov/cas/techalerts/TA04-245A.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18656