PT-2009-1222 · Oracle · Oracle Database

Sh2Kerr · Publicado 2009-01-14 · Atualizado 2018-10-11 · CVE-2008-3979

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 10.1.0.5 through 10.2.0.2

Description The issue affects confidentiality and integrity, potentially allowing remote authenticated users to gain privileges via unknown vectors. Researchers claim it may be a SQL injection vulnerability, specifically allowing access to MDSYS privileges through the MDSYS.SDO TOPO DROP FTBL trigger.

Recommendations For Oracle Database versions 10.1.0.5 through 10.2.0.2, consider restricting access to the MDSYS.SDO TOPO DROP FTBL trigger as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2008-3979

Produtos afetados

Oracle Database

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/droptable_trigger.rb · Exploit
• 🔥 https://exploit-db.com/exploits/8074 · Exploit
• http://vupen.com/english/advisories/2009/0115 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3979 · Nota
• http://securityfocus.com/bid/33177 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3979 · Nota de Segurança
• http://osvdb.org/51354 · Nota
• http://secunia.com/advisories/33525 · Aviso do Fabricante
• http://securitytracker.com/id?1021561 · Nota
• http://securityfocus.com/archive/1/500061/100/0/threaded · Nota
• http://oracle.com/technetwork/topics/security/cpujan2009-097901.html · Nota