Vulnerability Description
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Forms | 3.0 |
References
- http://marc.info/?l=bugtraq&m=112180805413784&w=2
- http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.htExploitVendor Advisory
- http://marc.info/?l=bugtraq&m=112180805413784&w=2
- http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.htExploitVendor Advisory
FAQ
What is CVE-2005-2372?
CVE-2005-2372 is a vulnerability with a CVSS score of 7.2 (HIGH). Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a maliciou...
How severe is CVE-2005-2372?
CVE-2005-2372 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-2372?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Forms.