CVE-2008-2625
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
Does this matter?
Lower severity and a low EPSS score (2.07%). Track it; it rarely justifies an emergency change on its own.
Description
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the Oracle October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue involves an authentication bypass by establishing a TNS connection and impersonating a user session via a crafted authentication message during proxy authentication mode.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
- EPSS
- 2.07% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- oracle/database 10g · oracle/database 9i
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/32291Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html
- http://www.securityfocus.com/archive/1/497539/100/0/threaded
- http://www.securitytracker.com/id?1021050
- http://www.vupen.com/english/advisories/2008/2825Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45880
- http://secunia.com/advisories/32291Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html
- http://www.securityfocus.com/archive/1/497539/100/0/threaded
- http://www.securitytracker.com/id?1021050
- http://www.vupen.com/english/advisories/2008/2825Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45880
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.