PT-2009-3559 · Oracle · Oracle Database

Franz Hüll · Publicado 2009-04-15 · Atualizado 2018-10-10 · CVE-2009-0977

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.8 through 9.2.0.8DV Oracle Database versions 10.1.0.5 Oracle Database versions 10.2.0.3

Description The issue affects the Advanced Queuing component and is related to DBMS AQIN. It may allow remote authenticated users to impact confidentiality and integrity. There are claims that this issue could be related to SQL injection in the GRANT TYPE ACCESS procedure within the DBMS AQADM SYS package.

Recommendations For Oracle Database version 9.2.0.8, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 9.2.0.8DV, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 10.1.0.5, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 10.2.0.3, consider restricting access to the Advanced Queuing component until a fix is available. As a temporary workaround, consider disabling the GRANT TYPE ACCESS procedure in the DBMS AQADM SYS package to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2009-0977

Produtos afetados

Oracle Database

Referências · 9

• http://securityfocus.com/archive/1/502727/100/0/threaded · Nota
• http://securityfocus.com/bid/34461 · Nota
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0977 · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0977 · Nota de Segurança
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_aqadm_sys.html · Nota
• http://secunia.com/advisories/34693 · Nota
• http://securitytracker.com/id?1022052 · Nota