PT-2006-6054 · Oracle · Oracle Database

Publicado 2006-10-18 · Atualizado 2018-10-17 · CVE-2006-5334

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5, 9.2.0.7, and 10.1.0.5

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, related to mdsys.md2. It has remote authenticated attack vectors and unknown impact. There are reports suggesting it may be related to either a buffer overflow in the RELATE function or SQL injection in the TESSELATE FIXED and TESSELATE functions.

Recommendations For Oracle Database version 9.0.1.5, consider restricting access to the mdsys.md2 component until a fix is available. For Oracle Database version 9.2.0.7, consider disabling the RELATE function as a temporary workaround. For Oracle Database version 10.1.0.5, avoid using the TESSELATE FIXED and TESSELATE functions until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-5334

Produtos afetados

Oracle Database

Referências · 12

• http://vupen.com/english/advisories/2006/4065 · Aviso do Fabricante
• http://secunia.com/advisories/22396 · Aviso do Fabricante
• http://securityfocus.com/archive/1/449711/100/0/threaded · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Nota
• http://securityfocus.com/archive/1/449110/100/0/threaded · Nota
• http://securitytracker.com/id?1017077 · Nota
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5334 · Nota
• http://securityfocus.com/bid/20588 · Correção
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Nota
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5334 · Nota de Segurança