PT-2006-1343 · Oracle · Oracle Database

Alexander Kornbrust + 8 · Published 2006-01-18 · Updated 2017-07-20 · CVE-2006-0269

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database server versions 10.1.0.5 through 10.2.0.1

Description The issue is related to an unspecified vulnerability in the Streams Capture component, potentially allowing SQL injection in the SET DIRECTORY ROOT function within the DBMS CDC PUBLISH package. Details about the vulnerability are limited due to unavailability from Oracle.

Recommendations For Oracle Database server versions 10.1.0.5 through 10.2.0.1, consider restricting access to the DBMS CDC PUBLISH package as a temporary mitigation measure until a patch is available. Avoid using the SET DIRECTORY ROOT function in the affected package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2006-0269

Affected Products

Oracle Database

References · 12

• http://secunia.com/advisories/18608 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0243 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0269 · Security Note
• http://secunia.com/advisories/18493 · Vendor Advisory
• http://osvdb.org/22563 · Note
• http://red-database-security.com/advisory/oracle_cpu_jan_2006.html · Note
• http://securityfocus.com/bid/16287 · Note
• http://oracle.com/technetwork/topics/security/cpujan2006-082403.html · Note
• http://securitytracker.com/id?1015499 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 · Note
• http://kb.cert.org/vuls/id/545804 · Note