PT-2005-2213 · Oracle · Oracle 10G Database Server+1

Alexander Kornbrust · Published 2005-04-21 · Updated 2016-10-18 · CVE-2005-1197

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server 10g

Description The issue allows remote attackers to execute arbitrary SQL commands and gain access to sensitive data. Specifically, a SQL injection vulnerability exists in the SYS.DBMS CDC IPUBLISH.CREATE SCN CHANGE SET procedure, where attackers can execute arbitrary SQL commands via the CHANGE SET NAME parameter.

Recommendations For Oracle Database Server 10g, consider restricting access to the SYS.DBMS CDC IPUBLISH.CREATE SCN CHANGE SET procedure to minimize the risk of exploitation. As a temporary workaround, avoid using the CHANGE SET NAME parameter in the affected procedure until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1197

Affected Products

Oracle Database

Oracle 10G Database Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-1197 · Security Note
• http://oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf · Vendor Advisory
• http://marc.info/?l=bugtraq&m=111385690419118&w=2 · Note
• http://us-cert.gov/cas/techalerts/TA05-117A.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1197 · Note
• http://kb.cert.org/vuls/id/948486 · Note