PT-2006-3062 · Oracle · Oracle Database Server

N1V1Hd $3C41R3Exploitbugtraq · Publicado 2006-04-27 · Atualizado 2018-10-18 · CVE-2006-2081

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server 10g Release 2

Description The issue allows local users to execute arbitrary SQL queries via the GET DOMAIN INDEX METADATA function in the DBMS EXPORT EXTENSION package. This is due to insecure privileges that facilitate the introduction of SQL, which is not related to special characters.

Recommendations For Oracle Database Server 10g Release 2, consider restricting access to the DBMS EXPORT EXTENSION package to minimize the risk of exploitation. As a temporary workaround, consider disabling the GET DOMAIN INDEX METADATA function until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-2081

Produtos afetados

Oracle Database Server

Referências · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/dbms_export_extension.rb · Exploit
• 🔥 http://red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html · Exploit
• 🔥 https://exploit-db.com/exploits/3269 · Exploit
• 🔥 https://exploit-db.com/exploits/1719 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2081 · Nota de Segurança
• http://securityfocus.com/bid/17699 · Nota
• http://secunia.com/advisories/19860 · Nota
• http://securityfocus.com/archive/1/431353/100/0/threaded · Nota
• http://securityreason.com/securityalert/802 · Nota
• http://kb.cert.org/vuls/id/932124 · Nota
• http://securitytracker.com/id?1015999 · Nota
• http://securityfocus.com/archive/1/432632/30/5250/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26048 · Nota
• http://securityfocus.com/archive/1/432354/100/0/threaded · Nota
• http://securityfocus.com/archive/1/432078/100/0/threaded · Nota