CVEvulnerability
CVE-2001-0943
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2001-08-31
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Description
dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.
Affected configurations
• oracle database server 8.0.5
• oracle database server 8.1.5
Related
Referenced by CWE · observed example (1)
- CWE-427 Uncontrolled Search Path Element weakness
References
- http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf otn.oracle.com
- http://seclists.org/lists/bugtraq/2001/Dec/0001.html seclists.org
- http://www.securityfocus.com/archive/1/201020 Exploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/3129 Patch, Vendor Advisory
- http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf otn.oracle.com
- http://seclists.org/lists/bugtraq/2001/Dec/0001.html seclists.org
- http://www.securityfocus.com/archive/1/201020 Exploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/3129 Patch, Vendor Advisory