CVE-2010-0070

Vulnerability

An unspecified vulnerability exists in the Oracle Containers for J2EE component of Oracle Application Server versions 10.1.2.3 and 10.1.3.4 [1]. The vulnerability is remotely exploitable via unknown vectors, as described in the Oracle Critical Patch Update January 2010 [1].

Exploitation

Remote attackers can exploit this vulnerability without authentication, as the description indicates remote access is sufficient [1]. The exact exploitation steps are not disclosed, but the attack vector is network-based [1].

Impact

Successful exploitation allows an attacker to affect the integrity of the system, potentially leading to unauthorized modification of data [1]. The specific scope of integrity compromise is not detailed in the available references.

Mitigation

Oracle released a Critical Patch Update in January 2010 that addresses this vulnerability [1]. Affected versions are Oracle Application Server 10.1.2.3 and 10.1.3.4; applying the CPU is the recommended mitigation. No workarounds are documented in the references.