PT-2006-4563 · Oracle · Oracle Database

Alexander Kornbrust · Published 2006-07-19 · Updated 2018-10-18 · CVE-2006-3698

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database version 10.1.0.5

Description The issue involves multiple unspecified vulnerabilities in the Oracle Database, with unknown impact and attack vectors. It is related to SQL injection vulnerabilities in certain procedures, including IMPORT CHANGE SET, IMPORT CHANGE TABLE, IMPORT CHANGE COLUMN, IMPORT SUBSCRIBER, IMPORT SUBSCRIBED TABLE, IMPORT SUBSCRIBED COLUMN, VALIDATE IMPORT, VALIDATE CHANGE SET, VALIDATE CHANGE TABLE, and VALIDATE SUBSCRIPTION in the SYS.DBMS CDC IMPDP component, as well as SQL injection in the MAIN procedure for SYS.KUPW$WORKER.

Recommendations For Oracle Database version 10.1.0.5, consider disabling the SYS.DBMS CDC IMPDP component and restricting access to the SYS.KUPW$WORKER procedure until a patch is available. Avoid using the vulnerable procedures, including IMPORT CHANGE SET, IMPORT CHANGE TABLE, IMPORT CHANGE COLUMN, IMPORT SUBSCRIBER, IMPORT SUBSCRIBED TABLE, IMPORT SUBSCRIBED COLUMN, VALIDATE IMPORT, VALIDATE CHANGE SET, VALIDATE CHANGE TABLE, and VALIDATE SUBSCRIPTION, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3698

Affected Products

Oracle Database

References · 23

• 🔥 https://exploit-db.com/exploits/3375 · Exploit
• 🔥 https://exploit-db.com/exploits/3358 · Exploit
• 🔥 https://exploit-db.com/exploits/3178 · Exploit
• http://red-database-security.com/advisory/oracle_cpu_july_2006.html · Vendor Advisory
• http://securityfocus.com/bid/19054 · Patch
• http://securityfocus.com/archive/1/440758/100/100/threaded · Vendor Advisory
• http://vupen.com/english/advisories/2006/2947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3698 · Security Note
• http://secunia.com/advisories/21111 · Vendor Advisory
• http://secunia.com/advisories/21165 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2863 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047994.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27888 · Note
• http://securityfocus.com/archive/1/440439/100/0/threaded · Note
• http://red-database-security.com/advisory/oracle_sql_injection_kupw%24worker.html · Note