PT-2006-1502 · Oracle · Oracle E-Business Suite/Applications+3

Alexander Kornbrust + 2 · Published 2006-01-26 · Updated 2018-10-19 · CVE-2006-0435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 9.2.0.7 through 10.1.0.5 Oracle Application Server versions 1.0.2.2 through 10.1.3.0.0 Oracle E-Business Suite and Applications version 11.5.10 Oracle Collaboration Suite versions 9.0.4.2 through 10.1.2.1

Description The issue allows attackers to bypass the PLSQLExclusion list, which is supposed to restrict access to certain packages and procedures. This bypass enables attackers to access excluded packages and procedures.

Recommendations For Oracle Database Server versions 9.2.0.7 through 10.1.0.5, update to a version that includes a fix for this issue. For Oracle Application Server versions 1.0.2.2 through 10.1.3.0.0, update to a version that includes a fix for this issue. For Oracle E-Business Suite and Applications version 11.5.10, update to a version that includes a fix for this issue. For Oracle Collaboration Suite versions 9.0.4.2 through 10.1.2.1, update to a version that includes a fix for this issue.

Fix

Related Identifiers

CVE-2006-0435

Affected Products

Oracle Application Server

Oracle Collaboration Suite

Oracle Database Server

Oracle E-Business Suite/Applications

References · 27

• http://securityfocus.com/archive/1/432267/100/0/threaded · Vendor Advisory
• http://securitytracker.com/id?1015961 · Patch
• http://vupen.com/english/advisories/2006/1571 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0435 · Security Note
• http://vupen.com/english/advisories/2006/1397 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0338 · Vendor Advisory
• http://secunia.com/advisories/19712 · Vendor Advisory
• http://secunia.com/advisories/19859 · Vendor Advisory
• http://securityreason.com/securityalert/402 · Note
• http://securityfocus.com/bid/16384 · Note
• http://securityfocus.com/archive/1/424394/100/0/threaded · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041898.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041899.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041742.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24363 · Note