PT-2006-6062 · Oracle · Oracle Database

Published 2006-10-18 · Updated 2018-10-17 · CVE-2006-5342

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5, 9.2.0.6, and 10.1.0.3

Description The issue concerns an unspecified vulnerability in the Oracle Spatial component, which may be related to SQL injection in the EXTENT OF function. It has unknown impact and remote authenticated attack vectors, particularly related to mdsys.sdo tune. There are reports from reliable third parties suggesting a potential link to SQL injection, although Oracle has not confirmed this as of the specified date.

Recommendations For Oracle Database version 9.0.1.5, consider restricting access to the mdsys.sdo tune component until a fix is available. For Oracle Database version 9.2.0.6, avoid using the EXTENT OF function in the Oracle Spatial component to minimize potential risks. For Oracle Database version 10.1.0.3, as a temporary workaround, consider disabling the mdsys.sdo tune component to prevent potential exploitation.

Fix

Related Identifiers

CVE-2006-5342

Affected Products

Oracle Database

References · 12

• http://vupen.com/english/advisories/2006/4065 · Vendor Advisory
• http://secunia.com/advisories/22396 · Vendor Advisory
• http://securityfocus.com/archive/1/449711/100/0/threaded · Vendor Advisory
• http://securityfocus.com/bid/20588 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5342 · Security Note
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Note
• http://securityfocus.com/archive/1/449110/100/0/threaded · Note
• http://securitytracker.com/id?1017077 · Note
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5342 · Note
• http://databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf · Note
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Note