PT-2005-2492 · Oracle · Oracle 10G

Alexander Kornbrust · Publicado 2005-05-11 · Atualizado 2017-07-11 · CVE-2005-1496

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle 10g

Description The issue allows remote attackers with CREATE JOB privileges to gain additional privileges. This is achieved by changing the SESSION USER to the SYS user, potentially leading to elevated access.

Recommendations For Oracle 10g, consider restricting the CREATE JOB privilege to minimize the risk of exploitation. As a temporary workaround, monitor and limit changes to the SESSION USER, especially attempts to switch to the SYS user, until a more permanent solution is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-1496

Produtos afetados

Oracle 10G

Referências · 6

• 🔥 http://securityfocus.com/bid/13509 · Exploit
• 🔥 http://red-database-security.com/exploits/oracle_exploit_dbms_scheduler_select_user.html · Exploit
• http://marc.info/?l=bugtraq&m=111531740305049&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1496 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1496 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20410 · Nota