PT-2006-1611 · Oracle · Oracle Database

Publicado 2006-02-04 · Atualizado 2017-07-20 · CVE-2006-0547

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 8i, 9i, and 10g

Description The issue allows remote authenticated users to execute arbitrary SQL statements in the context of the SYS user, bypassing audit logging. This can include creating new privileged database accounts. The vulnerability is exploited via a modified AUTH ALTER SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol.

Recommendations For Oracle Database versions 8i, 9i, and 10g, consider restricting access to the SYS user and limiting the execution of arbitrary SQL statements until a fix is available. As a temporary workaround, consider disabling the modification of the AUTH ALTER SESSION attribute in the TNS protocol to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0547

Produtos afetados

Oracle Database

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0547 · Nota
• http://red-database-security.com/advisory/oracle_cpu_jan_2006.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24184 · Nota
• http://kb.cert.org/vuls/id/871756 · Nota
• http://us-cert.gov/cas/techalerts/TA06-018A.html · Nota
• http://integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf · Aviso do Fabricante
• http://oracle.com/technology/deploy/security/pdf/cpujan2006.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0547 · Nota de Segurança
• http://imperva.com/application_defense_center/papers/oracle-dbms-01172006.html · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041464.html · Nota