PT-2005-2213 · Oracle · Oracle 10G Database Server+1

Alexander Kornbrust · Publicado 2005-04-21 · Atualizado 2016-10-18 · CVE-2005-1197

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server 10g

Description The issue allows remote attackers to execute arbitrary SQL commands and gain access to sensitive data. Specifically, a SQL injection vulnerability exists in the SYS.DBMS CDC IPUBLISH.CREATE SCN CHANGE SET procedure, where attackers can execute arbitrary SQL commands via the CHANGE SET NAME parameter.

Recommendations For Oracle Database Server 10g, consider restricting access to the SYS.DBMS CDC IPUBLISH.CREATE SCN CHANGE SET procedure to minimize the risk of exploitation. As a temporary workaround, avoid using the CHANGE SET NAME parameter in the affected procedure until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-1197

Produtos afetados

Oracle Database

Oracle 10G Database Server

Referências · 6

• http://marc.info/?l=bugtraq&m=111385690419118&w=2 · Nota
• http://us-cert.gov/cas/techalerts/TA05-117A.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1197 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1197 · Nota de Segurança
• http://oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf · Aviso do Fabricante
• http://kb.cert.org/vuls/id/948486 · Nota