PT-2006-2860 · Oracle · Oracle Database Server

Alexander Kornbrust · Publicado 2006-04-20 · Atualizado 2018-10-18 · CVE-2006-1876

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 9.2.0.7 through 10.1.0.4

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, potentially related to SQL injection in the GEN RID RANGE BY AREA and GEN RID RANGE functions within the MDSYS.SDO PRIDX package. Details about the vulnerability are limited due to unavailability from Oracle.

Recommendations For Oracle Database Server versions 9.2.0.7 through 10.1.0.4, consider restricting access to the MDSYS.SDO PRIDX package or temporarily disabling the GEN RID RANGE BY AREA and GEN RID RANGE functions as a mitigation measure until more information is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-1876

Produtos afetados

Oracle Database Server

Referências · 13

• 🔥 http://securityfocus.com/bid/17590 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1876 · Nota de Segurança
• http://securityfocus.com/archive/1/432267/100/0/threaded · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1397 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1571 · Aviso do Fabricante
• http://securitytracker.com/id?1015961 · Correção
• http://secunia.com/advisories/19712 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26051 · Nota
• http://kb.cert.org/vuls/id/240249 · Nota
• http://red-database-security.com/advisory/oracle_cpu_apr_2006.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1876 · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2006-090826.html · Nota
• http://secunia.com/advisories/19859 · Aviso do Fabricante