Oracle Database Vault Cross-Site Request Forgery Vulnerability

Bugtraq ID:	45905
Class:	Unknown
CVE:	CVE-2010-4421
Remote:	Yes
Local:	No
Published:	Jan 19 2011 12:00AM
Updated:	Jan 21 2011 07:21PM
Credit:	Oracle
Vulnerable:	Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Standard Edition 11.2.0.1 R2 Oracle Oracle10g Standard Edition 10.2 .5 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2.0.4 Oracle Oracle10g Personal Edition 10.2 .5 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2.0.4 Oracle Oracle10g Enterprise Edition 10.2 .5 Oracle Oracle10g Enterprise Edition 10.2.0.4
Not Vulnerable:

Oracle Database Vault Cross-Site Request Forgery Vulnerability

Oracle Database Vault is prone to a cross-site request forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized administrative access to the affected application, potentially compromising the affected computer; other attacks are also possible.

This vulnerability affects the following supported versions:
10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.1

Oracle Database Vault Cross-Site Request Forgery Vulnerability

Attackers can exploit this issue by tricking an unsuspecting victim into following a malicious URI.

Oracle Database Vault Cross-Site Request Forgery Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Database Vault Cross-Site Request Forgery Vulnerability

References:

• Oracle Critical Patch Update Advisory - January 2011 (Oracle)
  
• Oracle Database Vault Administrator web console vulnerable to Cross-site request (Team Shatter)