PT-2006-4570 · Oracle · Oracle Database

Alexander Kornbrust · Publicado 2006-07-19 · Atualizado 2018-10-18 · CVE-2006-3705

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database version 10.1.0.5

Description The issue concerns multiple unspecified vulnerabilities in Oracle Database. These vulnerabilities have unknown impact and attack vectors. It is claimed by a researcher that one of the vulnerabilities is a local SQL injection issue in SYS.DBMS STATS, and another is an SQL injection vulnerability in SYS.DBMS UPGRADE.

Recommendations For Oracle Database version 10.1.0.5, as a temporary workaround, consider restricting access to SYS.DBMS STATS and SYS.DBMS UPGRADE to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-3705

Produtos afetados

Oracle Database

Referências · 22

• http://red-database-security.com/advisory/oracle_cpu_july_2006.html · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047992.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3705 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3705 · Nota
• http://securityfocus.com/bid/19054 · Correção
• http://securityfocus.com/archive/1/440453/100/0/threaded · Nota
• http://securityfocus.com/archive/1/440758/100/100/threaded · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047993.html · Nota
• http://vupen.com/english/advisories/2006/2947 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27887 · Nota
• http://securitytracker.com/id?1016529 · Nota
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27897 · Nota
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_stats.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27886 · Nota