PT-2008-3345 · Oracle · Oracle Database

Published 2008-04-16 · Updated 2018-10-11 · CVE-2008-1813

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5 FIPS+ through 10.2.0.3

Description The issue affects multiple components of Oracle Database, including Advanced Queuing, Core RDBMS, Oracle Spatial, Export, and Query Optimizer. The vulnerabilities have unknown impact and can be exploited remotely by unauthenticated or authenticated attackers. The affected components include SYS.DBMS AQ, Core RDBMS, SDO GEOM, Export, and DBMS STATS. Researchers claim that one of the vulnerabilities may be related to SQL injection, and another occurs when the OUTLN account is reset to use a hard-coded password.

Recommendations For Oracle Database versions 9.0.1.5 FIPS+ through 10.2.0.3, consider restricting access to the vulnerable components, such as SYS.DBMS AQ, SDO GEOM, and DBMS STATS, until a patch is available. As a temporary workaround, avoid using the OUTLN account with a hard-coded password. Additionally, restrict access to the Export component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-1813

Affected Products

Oracle Database

References · 19

• http://securityfocus.com/archive/1/491024/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1813 · Security Note
• http://secunia.com/advisories/29829 · Vendor Advisory
• http://secunia.com/advisories/29874 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1233/references · Vendor Advisory
• http://vupen.com/english/advisories/2008/1267/references · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41858 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41992 · Note
• http://securityfocus.com/archive/1/490950/100/0/threaded · Note
• http://oracle.com/technetwork/topics/security/cpuapr2008-082075.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41995 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1813 · Note
• http://securityfocus.com/archive/1/490919/100/0/threaded · Note
• http://red-database-security.com/advisory/oracle_sql_injection_sdo_geom.html · Note
• http://red-database-security.com/advisory/oracle_outln_password_change.html · Note