Oracle Database Server Database Vault Local Information Disclosure Vulnerability

Bugtraq ID:	45855
Class:	Design Error
CVE:	CVE-2010-4420
Remote:	No
Local:	Yes
Published:	Jan 18 2011 12:00AM
Updated:	Jan 21 2011 07:31PM
Credit:	Oracle
Vulnerable:	Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Standard Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.1.0.7 Oracle Oracle10g Standard Edition 10.2 .5 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2.0.4 Oracle Oracle10g Personal Edition 10.2 .5 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2.0.4 Oracle Oracle10g Enterprise Edition 10.2 .5 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 11.2.0.1 Oracle Oracle10g Enterprise Edition 11.1.0.7 Oracle Oracle10g Enterprise Edition 10.2.0.4
Not Vulnerable:

Oracle Database Server Database Vault Local Information Disclosure Vulnerability

Oracle Database is prone to a local information-disclosure vulnerability in Database Vault.

A local attacker can exploit this issue to acquire the Session ID of an administrator of the affected application; this may aid in further attacks.

This vulnerability affects the following supported versions:
10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.1

Oracle Database Server Database Vault Local Information Disclosure Vulnerability

An attacker requires local interactive access to a computer running the affected application to exploit this issue.

Oracle Database Server Database Vault Local Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Database Server Database Vault Local Information Disclosure Vulnerability

References:

• Oracle Critical Patch Update Advisory - January 2011 (Oracle)
  
• Oracle Database Vault Administrator web console Session ID disclosure (Team Shatter)