PT-2006-2860 · Oracle · Oracle Database Server

Alexander Kornbrust · Published 2006-04-20 · Updated 2018-10-18 · CVE-2006-1876

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 9.2.0.7 through 10.1.0.4

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, potentially related to SQL injection in the GEN RID RANGE BY AREA and GEN RID RANGE functions within the MDSYS.SDO PRIDX package. Details about the vulnerability are limited due to unavailability from Oracle.

Recommendations For Oracle Database Server versions 9.2.0.7 through 10.1.0.4, consider restricting access to the MDSYS.SDO PRIDX package or temporarily disabling the GEN RID RANGE BY AREA and GEN RID RANGE functions as a mitigation measure until more information is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1876

Affected Products

Oracle Database Server

References · 13

• 🔥 http://securityfocus.com/bid/17590 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1876 · Security Note
• http://securityfocus.com/archive/1/432267/100/0/threaded · Vendor Advisory
• http://vupen.com/english/advisories/2006/1397 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1571 · Vendor Advisory
• http://securitytracker.com/id?1015961 · Patch
• http://secunia.com/advisories/19712 · Vendor Advisory
• http://secunia.com/advisories/19859 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26051 · Note
• http://kb.cert.org/vuls/id/240249 · Note
• http://red-database-security.com/advisory/oracle_cpu_apr_2006.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1876 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2006-090826.html · Note