Oracle Enterprise Manager for Oracle Database CVE-2012-1737 Multiple SQL Injection Vulnerabilities

Bugtraq ID:	54569
Class:	Input Validation Error
CVE:	CVE-2012-1737
Remote:	Yes
Local:	No
Published:	Jul 17 2012 12:00AM
Updated:	Oct 05 2012 10:10AM
Credit:	Oracle
Vulnerable:	SuSE Manager (for SLE 11 SP1) 1.2 Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Standard Edition 11.2.0.3 Oracle Oracle11g Standard Edition 11.2.0.2.0 Oracle Oracle11g Standard Edition 11.1.0.7 R1 Oracle Oracle11g Enterprise Edition 11.2 2 Oracle Oracle11g Enterprise Edition 11.2.0.3 Oracle Oracle11g Enterprise Edition 11.1.0.7 R1 Oracle Oracle11g Enterprise Edition 11.1.0.7 Oracle Enterprise Manager 11.1.0.1 Oracle Enterprise Manager 10.2.0.5
Not Vulnerable:

Oracle Enterprise Manager for Oracle Database CVE-2012-1737 Multiple SQL Injection Vulnerabilities

Oracle Enterprise Manager for Oracle Database is prone to multiple SQL-injection vulnerabilities.

The vulnerabilities can be exploited over the 'HTTP' protocol. The 'DB Performance Advisories/UIs' sub component is affected.

These vulnerabilities affect the following supported versions:
EM Base Platform 10.2.0.5, EM Base Platform 11.1.0.1, EM Plugin for DB 12.1.0.1, EM Plugin for DB 12.1.0.2

Oracle Enterprise Manager for Oracle Database CVE-2012-1737 Multiple SQL Injection Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Enterprise Manager for Oracle Database CVE-2012-1737 Multiple SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Enterprise Manager for Oracle Database CVE-2012-1737 Multiple SQL Injection Vulnerabilities

References:

• Oracle Homepage (Oracle)