NetSight
IP …
high7.8

CVE-2004-1368

ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix sc…

Impact

ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.

Affected products

VendorProductAffected versions
OracleApplication Server
All versions
Versions 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2
OracleCollaboration Suite
Version release_1
OracleE-Business Suite
Versions 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6
OracleEnterprise Manager
Versions 9, 9.0.1
OracleEnterprise Manager Database Control
Version 10.1.2
OracleEnterprise Manager Grid Control
Version 10.1.0.2
OracleOracle10g
Versions enterprise_9.0.4_.0, enterprise_10.1.0.2, personal_9.0.4_.0, personal_10.1_.0.2, standard_9.0.4_.0, standard_10.1_.0.2
OracleOracle8i
Versions enterprise_8.0.5_.0.0, enterprise_8.0.6_.0.0, enterprise_8.0.6_.0.1, enterprise_8.1.5_.0.0, enterprise_8.1.5_.0.2, enterprise_8.1.5_.1.0
OracleOracle9i
Versions client_9.2.0.1, client_9.2.0.2, enterprise_8.1.7, enterprise_9.0.1, enterprise_9.0.1.4, enterprise_9.0.1.5

References