{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-01-13T00:00:00", "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this is a format string vulnerability via the msg parameter in the evtdump CGI module."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"name": "33525", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/33525"}, {"name": "20090114 Oracle TimesTen Remote Format String", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/500080/100/0/threaded"}, {"name": "ADV-2009-0115", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/0115"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004/"}, {"name": "33177", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/33177"}, {"name": "20090114 ZDI-09-004: Oracle TimesTen evtdump Remote Format String Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/500078/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://joxeankoret.com/blog/?p=41"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2008-5440", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this is a format string vulnerability via the msg parameter in the evtdump CGI module."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "33525", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/33525"}, {"name": "20090114 Oracle TimesTen Remote Format String", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/500080/100/0/threaded"}, {"name": "ADV-2009-0115", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/0115"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-09-004/", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004/"}, {"name": "33177", "refsource": "BID", "url": "http://www.securityfocus.com/bid/33177"}, {"name": "20090114 ZDI-09-004: Oracle TimesTen evtdump Remote Format String Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/500078/100/0/threaded"}, {"name": "http://joxeankoret.com/blog/?p=41", "refsource": "MISC", "url": "http://joxeankoret.com/blog/?p=41"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-09-004", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004"}]}}}}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2008-5440", "datePublished": "2009-01-14T01:00:00", "dateReserved": "2008-12-11T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:timesten_in-memory_database:7.0.5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "4E14CAC2-894A-4D70-94ED-EB3C3EAE5572", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this is a format string vulnerability via the msg parameter in the evtdump CGI module."}, {"lang": "es", "value": "Una vulnerabilidad no especificada en el componente TimesTen Data Server de Oracle Database versi\u00f3n 7.0.5.0.0.0, permite a los atacantes remotos afectar a la confidencialidad, integridad y disponibilidad por medio de vectores desconocidos. NOTA: la informaci\u00f3n anterior fue obtenida de la CPU de enero de 2009. Oracle no ha comentado sobre las afirmaciones de investigadores confiables de que se trata de una vulnerabilidad de cadena de formato por medio del par\u00e1metro msg en el m\u00f3dulo CGI de evtdump."}], "id": "CVE-2008-5440", "lastModified": "2018-10-11T20:55:25.877", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-01-14T01:30:00.657", "references": [{"source": "secalert_us@oracle.com", "url": "http://joxeankoret.com/blog/?p=41"}, {"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/33525"}, {"source": "secalert_us@oracle.com", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/archive/1/500078/100/0/threaded"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/archive/1/500080/100/0/threaded"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/bid/33177"}, {"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/0115"}, {"source": "secalert_us@oracle.com", "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004"}, {"source": "secalert_us@oracle.com", "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-004/"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}