CVE-2009-1979

Estado: ModificadaAlta (10)—💥 Exploit

Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an independent researcher that this is related to improper validation of the AUTH_SESSKEY parameter length that leads to arbitrary code execution.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 76%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow
Publicado en Exploit-DB · Oracle 10gR2 - TNS Listener AUTH_SESSKEY Buffer Overflow (Metasploit) (24/11/2010)
Publicado en Exploit-DB · Oracle Database 10.1.0.5 < 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow (30/10/2009)

Tecnologías afectadas (1)

Oracle — Database Server

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2009-1979",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-10-22T18:30:00.390",
  "references": [
    {
      "url": "http://blogs.conus.info/node/28",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://osvdb.org/59110",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://secunia.com/advisories/37027",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507598/100/0/threaded",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/36747",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1023057",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://blogs.conus.info/node/28",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/59110",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37027",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507598/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36747",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1023057",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2009 CPU.  Oracle has not commented on claims from an independent researcher that this is related to improper validation of the AUTH_SESSKEY parameter length that leads to arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en el componente Network Authentication en Oracle Database v10.1.0.5 y v10.2.0.4 permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores no conocidos."
    }
  ],
  "lastModified": "2026-06-16T23:08:29.353",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03A522A3-07D7-481F-A538-EA3D13256F63"
            },
            {
              "criteria": "cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4AC251D-9313-4A54-9623-51DC0AEC46FC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorImpact": "Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html\r\n\r\n# The CVSS Base Score is 10.0 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 7.5, and the impacts for Confidentiality, Integrity and Availability are Partial+.",
  "sourceIdentifier": "secalert_us@oracle.com"
}