PT-2006-3452 · Oracle · Oracle Database Server

David Litchfield · Published 2006-05-22 · Updated 2018-10-18 · CVE-2006-2505

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server 10g Release 2

Description The issue allows local users to execute arbitrary SQL queries by referencing a malicious package in the TYPE NAME argument within the GET DOMAIN INDEX TABLES or GET V2 DOMAIN INDEX TABLES function in the DBMS EXPORT EXTENSION package.

Recommendations For Oracle Database Server 10g Release 2, consider restricting access to the DBMS EXPORT EXTENSION package to minimize the risk of exploitation. As a temporary workaround, avoid using the TYPE NAME argument in the affected functions until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2006-2505

Affected Products

Oracle Database Server

References · 10

• 🔥 https://exploit-db.com/exploits/3269 · Exploit
• 🔥 http://secunia.com/advisories/19860 · Exploit
• 🔥 https://exploit-db.com/exploits/1719 · Exploit
• 🔥 http://securityfocus.com/bid/17699 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2505 · Security Note
• http://kb.cert.org/vuls/id/932124 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2505 · Note
• http://securityfocus.com/archive/1/432354/100/0/threaded · Note
• http://securityfocus.com/archive/1/432078/100/0/threaded · Note
• http://securityfocus.com/archive/1/432355/100/0/threaded · Note