PT-2006-6054 · Oracle · Oracle Database

Published 2006-10-18 · Updated 2018-10-17 · CVE-2006-5334

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5, 9.2.0.7, and 10.1.0.5

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, related to mdsys.md2. It has remote authenticated attack vectors and unknown impact. There are reports suggesting it may be related to either a buffer overflow in the RELATE function or SQL injection in the TESSELATE FIXED and TESSELATE functions.

Recommendations For Oracle Database version 9.0.1.5, consider restricting access to the mdsys.md2 component until a fix is available. For Oracle Database version 9.2.0.7, consider disabling the RELATE function as a temporary workaround. For Oracle Database version 10.1.0.5, avoid using the TESSELATE FIXED and TESSELATE functions until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5334

Affected Products

Oracle Database

References · 12

• http://vupen.com/english/advisories/2006/4065 · Vendor Advisory
• http://secunia.com/advisories/22396 · Vendor Advisory
• http://securityfocus.com/archive/1/449711/100/0/threaded · Vendor Advisory
• http://securityfocus.com/bid/20588 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5334 · Security Note
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Note
• http://securityfocus.com/archive/1/449110/100/0/threaded · Note
• http://securitytracker.com/id?1017077 · Note
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5334 · Note
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Note
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Note