PT-2006-6061 · Oracle · Oracle Database

Alexander Kornbrust · Publicado 2006-10-17 · Atualizado 2018-10-17 · CVE-2006-5341

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.8 through 10.2.0.2

Description The issue concerns multiple unspecified vulnerabilities in the XMLDB component of Oracle Database, allowing remote authenticated attacks. These vulnerabilities are related to SQL injection in specific functions, including PITRIG DROP and PITRIG DROPMETADATA in XDB PITRIG PKG, and DISABLE HIERARCHY INTERNAL in DBMS XDBZ. This can enable remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data.

Recommendations For Oracle Database versions 9.2.0.8 through 10.2.0.2, consider disabling the XDB PITRIG PKG and DBMS XDBZ packages as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive data and limit the execution of arbitrary SQL commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-5341

Produtos afetados

Oracle Database

Referências · 15

• http://securityfocus.com/archive/1/449711/100/0/threaded · Aviso do Fabricante
• http://secunia.com/advisories/22396 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4065 · Nota
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Nota
• http://securityfocus.com/archive/1/449110/100/0/threaded · Nota
• http://securityfocus.com/archive/1/449510/100/0/threaded · Nota
• http://securitytracker.com/id?1017077 · Nota
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_xdbz0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5341 · Nota de Segurança
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Nota
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Nota
• http://securityfocus.com/bid/20588 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5341 · Nota
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Nota
• http://kb.cert.org/vuls/id/318764 · Nota