CVE-2007-6260 - Vulnerability Details - OpenCVE

The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00872.

Key SSVC decision points have not yet been added.

Vendors	Products
Oracle	Database Server

Configuration 1 [-]

cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-6228	The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/43673
http://securityreason.com/securityalert/3419
http://www.davidlitchfield.com/blog/archives/00000030.htm
http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf
http://www.securityfocus.com/archive/1/483652/100/200/threaded
http://www.securityfocus.com/bid/26425

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-12-06T02:00:00

Updated: 2024-08-07T16:02:35.936Z

Reserved: 2007-12-05T00:00:00

Link: CVE-2007-6260

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-12-06T02:46:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-6260

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-11-13T00:00:00", "descriptions": [{"lang": "en", "value": "The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.davidlitchfield.com/blog/archives/00000030.htm"}, {"name": "43673", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/43673"}, {"name": "3419", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3419"}, {"name": "26425", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26425"}, {"name": "20071113 Oracle 11g/10g Installation Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/483652/100/200/threaded"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-6260", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.davidlitchfield.com/blog/archives/00000030.htm", "refsource": "MISC", "url": "http://www.davidlitchfield.com/blog/archives/00000030.htm"}, {"name": "43673", "refsource": "OSVDB", "url": "http://osvdb.org/43673"}, {"name": "3419", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3419"}, {"name": "26425", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26425"}, {"name": "20071113 Oracle 11g/10g Installation Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/483652/100/200/threaded"}, {"name": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf", "refsource": "CONFIRM", "url": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T16:02:35.936Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.davidlitchfield.com/blog/archives/00000030.htm"}, {"name": "43673", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/43673"}, {"name": "3419", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3419"}, {"name": "26425", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26425"}, {"name": "20071113 Oracle 11g/10g Installation Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/483652/100/200/threaded"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-6260", "datePublished": "2007-12-06T02:00:00", "dateReserved": "2007-12-05T00:00:00", "dateUpdated": "2024-08-07T16:02:35.936Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A77562B-D1A5-450D-9288-3FC7145E9292", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed."}, {"lang": "es", "value": "El proceso de instalaci\u00f3n de Oracle 10g y llg utiliza cuentas con contrase\u00f1as por defecto, lo cual permite a atacantes remotos obtener acceso autenticado conect\u00e1ndose al Listener. NOTA: al final de la instalaci\u00f3n, si se lleva a cabo utilizando el Asistente de Configuraci\u00f3n de Base de Datos (DBCA), la mayor\u00eda de las cuentas son deshabilitadas o sus contrase\u00f1as son cambiadas."}], "id": "CVE-2007-6260", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-12-06T02:46:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/43673"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3419"}, {"source": "cve@mitre.org", "url": "http://www.davidlitchfield.com/blog/archives/00000030.htm"}, {"source": "cve@mitre.org", "url": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/483652/100/200/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26425"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/43673"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3419"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.davidlitchfield.com/blog/archives/00000030.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/483652/100/200/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26425"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}