PT-2006-3452 · Oracle · Oracle Database Server

David Litchfield · Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2505

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server 10g Release 2

Description The issue allows local users to execute arbitrary SQL queries by referencing a malicious package in the TYPE NAME argument within the GET DOMAIN INDEX TABLES or GET V2 DOMAIN INDEX TABLES function in the DBMS EXPORT EXTENSION package.

Recommendations For Oracle Database Server 10g Release 2, consider restricting access to the DBMS EXPORT EXTENSION package to minimize the risk of exploitation. As a temporary workaround, avoid using the TYPE NAME argument in the affected functions until a fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-2505

Produtos afetados

Oracle Database Server

Referências · 10

• 🔥 https://exploit-db.com/exploits/3269 · Exploit
• 🔥 http://secunia.com/advisories/19860 · Exploit
• 🔥 https://exploit-db.com/exploits/1719 · Exploit
• 🔥 http://securityfocus.com/bid/17699 · Exploit
• http://kb.cert.org/vuls/id/932124 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2505 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2505 · Nota de Segurança
• http://securityfocus.com/archive/1/432354/100/0/threaded · Nota
• http://securityfocus.com/archive/1/432078/100/0/threaded · Nota
• http://securityfocus.com/archive/1/432355/100/0/threaded · Nota