PT-2006-1332 · Oracle · Oracle Database

David Litchfield · Published 2006-01-18 · Updated 2017-07-20 · CVE-2006-0257

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database server versions 9.2.0.7, 10.1.0.5, and 10.2.0.1

Description The issue is related to an unspecified vulnerability in the Change Data Capture component, potentially allowing SQL injection in the CDC ALLOCATE LOCK function of the DBMS CDC UTILITY package. Details about the impact and attack vectors are unavailable due to limited information from Oracle.

Recommendations For Oracle Database server version 9.2.0.7, consider restricting access to the DBMS CDC UTILITY package until a fix is available. For Oracle Database server version 10.1.0.5, consider disabling the CDC ALLOCATE LOCK function as a temporary workaround. For Oracle Database server version 10.2.0.1, avoid using the DBMS CDC UTILITY package until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0257

Affected Products

Oracle Database

References · 12

• 🔥 http://securityfocus.com/bid/16287 · Exploit
• http://secunia.com/advisories/18608 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0243 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0323 · Vendor Advisory
• http://securitytracker.com/id?1015499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0257 · Security Note
• http://secunia.com/advisories/18493 · Vendor Advisory
• http://osvdb.org/22540 · Note
• http://oracle.com/technetwork/topics/security/cpujan2006-082403.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0257 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 · Note
• http://kb.cert.org/vuls/id/545804 · Note