{"vuid":"VU#948486","idnumber":"948486","name":"Oracle products contain multiple vulnerabilities","keywords":["Oracle Database","Database Server","Collaboration Suite","E-Business Suite and Applications","Enterprise Manager","Enterprise Manager Grid Control","PeopleSoft EnterpriseOne","PeopleSoft OneWorldXe","oracle_cpu_april_2005"],"overview":"Multiple vulnerabilities exist in numerous Oracle products. The impacts of these vulnerabilities are varied and may include remote execution of arbitrary code, the diclosure of sensitive information, and  denial-of-service conditions.","clean_desc":"Multiple vulnerabilities exist in numerous Oracle products including: Oracle Database Server\nOracle Application Server\nOracle Collaboration Suite\nOracle E-Business Suite\nOracle Enterprise Manager Grid Control\nOracle PeopleSoft Applications According to public reports, many of the vulnerabilities that affect the Oracle HTTP Server, which is strongly based on Apache HTTP Server, have been publicly known for some time. For more details concerning vulnerabilities and the conditions necessary to exploit them, please refer to the Oracle Critical Patch Update for April 2005.","impact":"The complete impact of these issues vary depending on the particular application and vulnerability being attacked. Potential consequences may include the remote execution of arbitrary code, disclosure of sensitive information, and denial-of-service conditions. Database compromises may result in the diclosure of sensitive personal information, such as credit card numbers, social security numbers, and health and patient information.","resolution":"Apply Patch Apply the appropriate patch or upgrade as specified in the Oracle Critical Patch Update for April 2005.","workarounds":"","sysaffected":"","thanks":"Thanks to Alexander Kornbrust of \nRed Database Security\n for helping us with these issues. This document is based on information contained in the \nOracle Critical Patch Update for April 2005 Oracle credits \nNGS Software Ltd. Integrigy\n, and \nApplication Security, Inc","author":"This document was written by Jeff Gennari.","public":["http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf","http://www.oracle.com/technology/deploy/security/alerts.htm","http://www.red-database-security.com/wp/comments_oracle_cpu_april_2005_us.pdf","http://secunia.com/advisories/14935/","http://www.ngssoftware.com/advisories/oracle-03.txt","http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.html .","http://www.oracle.com/oramag/oracle/02-mar/o22insight.html","http://www.oracle.com/oramag/oracle/02-mar/o22break.html"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-04-15T16:02:09Z","publicdate":"2005-04-12T00:00:00Z","datefirstpublished":"2005-04-27T17:49:48Z","dateupdated":"2005-04-28T13:54:07Z","revision":86,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"15","cam_population":"17","cam_impact":"19","cam_easeofexploitation":"18","cam_attackeraccessrequired":"17","cam_scorecurrent":"55.596375","cam_scorecurrentwidelyknown":"64.8624375","cam_scorecurrentwidelyknownexploited":"101.9266875","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":55.596375,"vulnote":null}