PT-2006-6053 · Oracle · Oracle Database

Published 2006-10-18 · Updated 2018-10-17 · CVE-2006-5333

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database version 10.2.0.2

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, which has remote authenticated attack vectors. It is related to "create session" privileges. Reports from reliable third parties suggest that this issue may be related to SQL injection in the SDO DROP USER BEFORE package. This potentially occurs when using a Trigger for a DROP USER statement in an anonymous PL/SQL block.

Recommendations For Oracle Database version 10.2.0.2, consider restricting access to the SDO DROP USER BEFORE package and avoid using Triggers for DROP USER statements in anonymous PL/SQL blocks until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5333

Affected Products

Oracle Database

References · 12

• http://vupen.com/english/advisories/2006/4065 · Vendor Advisory
• http://secunia.com/advisories/22396 · Vendor Advisory
• http://securityfocus.com/archive/1/449711/100/0/threaded · Vendor Advisory
• http://securityfocus.com/bid/20588 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5333 · Security Note
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Note
• http://securityfocus.com/archive/1/449110/100/0/threaded · Note
• http://securitytracker.com/id?1017077 · Note
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5333 · Note
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Note
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Note