Quantum Secular Labs / Blog / Advisories

CVE-2008-0347: Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2…

CVE-2008-0347 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Oracle Application Server, along with 4 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01. NOTE: Oracle has not disputed a reliable claim that this issue is related to WKSYS schema privileges.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Oracle Application Server: 1.0.2.2; 9.0.4.3; 10.1.2.0.2; 10.1.2.1.0; 10.1.2.2.0; 10.1.3.0.0; 10.1.3.1.0; 10.1.3.3.0
  • Oracle Collaboration Suite: 10.1.2
  • Oracle Application Server 9i: 9.0.4.3; 10.1.2.0.2
  • Oracle Database Server: 9.0.1.5; 9.2.0.8; 9.2.0.8dv; 10.1.0.5; 10.2.0.2; 10.2.0.3; 11.1.0.6
  • Oracle E Business Suite: 11.5.9; 11.5.10; 11.5.10.2; 12.0.0; 12.0.1; 12.0.2; 12.0.3
  • Oracle Peoplesoft Enterprise Peopletools: 8.47; 8.48; 8.49

References