Vulnerability Details : CVE-2007-5504
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+ and 10.1.0.5 unknown impact and remote attack vectors, related to (1) Import (DB01) and (2) Advanced Queuing (DB25). NOTE: as of 20071108, Oracle has not disputed reliable researcher claims that DB25 is for a buffer overflow in the DBLINK_INFO procedure in the DBMS_AQADM_SYS package.
Vulnerability category: Overflow
Exploit prediction scoring system (EPSS) score for CVE-2007-5504
Probability of exploitation activity in the next 30 days: 29.67%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-5504
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
References for CVE-2007-5504
- http://www.oracle.com/technetwork/topics/security/cpuoct2007-092913.html
-
http://www.appsecinc.com/resources/alerts/oracle/2007-08.shtml
-
http://www.vupen.com/english/advisories/2007/3524
Vendor Advisory
- http://www.securitytracker.com/id?1018823
-
http://www.us-cert.gov/cas/techalerts/TA07-290A.html
US Government Resource
-
http://www.vupen.com/english/advisories/2007/3626
Vendor Advisory
-
http://www.securityfocus.com/archive/1/482923/100/100/threaded
-
http://www.securityfocus.com/bid/26235
- http://marc.info/?l=bugtraq&m=119332677525918&w=2
Products affected by CVE-2007-5504
- cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*