PT-2006-6061 · Oracle · Oracle Database

Alexander Kornbrust · Published 2006-10-17 · Updated 2018-10-17 · CVE-2006-5341

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.8 through 10.2.0.2

Description The issue concerns multiple unspecified vulnerabilities in the XMLDB component of Oracle Database, allowing remote authenticated attacks. These vulnerabilities are related to SQL injection in specific functions, including PITRIG DROP and PITRIG DROPMETADATA in XDB PITRIG PKG, and DISABLE HIERARCHY INTERNAL in DBMS XDBZ. This can enable remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data.

Recommendations For Oracle Database versions 9.2.0.8 through 10.2.0.2, consider disabling the XDB PITRIG PKG and DBMS XDBZ packages as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive data and limit the execution of arbitrary SQL commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5341

Affected Products

Oracle Database

References · 15

• http://securityfocus.com/archive/1/449711/100/0/threaded · Vendor Advisory
• http://secunia.com/advisories/22396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5341 · Security Note
• http://securityfocus.com/bid/20588 · Patch
• http://vupen.com/english/advisories/2006/4065 · Note
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Note
• http://securityfocus.com/archive/1/449110/100/0/threaded · Note
• http://securityfocus.com/archive/1/449510/100/0/threaded · Note
• http://securitytracker.com/id?1017077 · Note
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_xdbz0.html · Note
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Note
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5341 · Note
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Note
• http://kb.cert.org/vuls/id/318764 · Note