PT-2006-4570 · Oracle · Oracle Database

Alexander Kornbrust · Published 2006-07-19 · Updated 2018-10-18 · CVE-2006-3705

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database version 10.1.0.5

Description The issue concerns multiple unspecified vulnerabilities in Oracle Database. These vulnerabilities have unknown impact and attack vectors. It is claimed by a researcher that one of the vulnerabilities is a local SQL injection issue in SYS.DBMS STATS, and another is an SQL injection vulnerability in SYS.DBMS UPGRADE.

Recommendations For Oracle Database version 10.1.0.5, as a temporary workaround, consider restricting access to SYS.DBMS STATS and SYS.DBMS UPGRADE to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3705

Affected Products

Oracle Database

References · 22

• http://red-database-security.com/advisory/oracle_cpu_july_2006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3705 · Security Note
• http://securityfocus.com/bid/19054 · Patch
• http://securityfocus.com/archive/1/440758/100/100/threaded · Vendor Advisory
• http://vupen.com/english/advisories/2006/2947 · Vendor Advisory
• http://secunia.com/advisories/21111 · Vendor Advisory
• http://secunia.com/advisories/21165 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2863 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047992.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3705 · Note
• http://securityfocus.com/archive/1/440453/100/0/threaded · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047993.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27887 · Note
• http://securitytracker.com/id?1016529 · Note
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade.html · Note