PT-2006-2859 · Oracle · Oracle Database Server

Published 2006-04-20 · Updated 2018-10-18 · CVE-2006-1875

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5

Description The issue is related to an unspecified vulnerability in the Oracle Spatial component, potentially allowing SQL injection in MDSYS.SDO LRS TRIG INS. The impact and attack vectors of this issue are unknown.

Recommendations For Oracle Database Server version 9.0.1.5, consider restricting access to the MDSYS.SDO LRS TRIG INS function until a patch is available. For Oracle Database Server version 9.2.0.7, consider restricting access to the MDSYS.SDO LRS TRIG INS function until a patch is available. For Oracle Database Server version 10.1.0.5, consider restricting access to the MDSYS.SDO LRS TRIG INS function until a patch is available.

Fix

Related Identifiers

CVE-2006-1875

Affected Products

Oracle Database Server

References · 12

• http://securityfocus.com/archive/1/432267/100/0/threaded · Vendor Advisory
• http://vupen.com/english/advisories/2006/1397 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1571 · Vendor Advisory
• http://securitytracker.com/id?1015961 · Patch
• http://securityfocus.com/bid/17590 · Patch
• http://secunia.com/advisories/19712 · Vendor Advisory
• http://secunia.com/advisories/19859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1875 · Security Note
• http://red-database-security.com/advisory/oracle_cpu_apr_2006.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26055 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1875 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2006-090826.html · Note