Description
ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.
References
- oracle-isqlplus-file-access(18656) vdb-entry
- 20041223 Oracle ISQLPlus file access vulnerability (#NISR2122004E) mailing-list
- http://www.ngssoftware.com/advisories/oracle23122004E.txt
- VU#435974 third-party-advisory
- TA04-245A third-party-advisory
- 10871 vdb-entry
- 101782 vendor-advisory