PT-2008-3348 · Oracle · Oracle Database

Alexander Kornbrust · Published 2008-04-16 · Updated 2018-10-11 · CVE-2008-1816

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 10.1.0.5 through 10.2.0.3

Description The issue is related to unspecified vulnerabilities in the Oracle Database, specifically in the Oracle Spatial component, referred to as SDO UTIL, and in the Audit component, related to fine grained auditing. These vulnerabilities have remote authenticated attack vectors, which means they can be exploited by attackers who have valid credentials to access the system. There are claims of SQL injection related to one of the vulnerabilities, but Oracle has not commented on this.

Recommendations For Oracle Database version 10.1.0.5, update to a version that is not affected by these vulnerabilities. For Oracle Database version 10.2.0.3, update to a version that is not affected by these vulnerabilities. As a temporary workaround, consider restricting access to the SDO UTIL function in the Oracle Spatial component and the fine grained auditing feature in the Audit component until a patch is available.

Fix

Related Identifiers

CVE-2008-1816

Affected Products

Oracle Database

References · 14

• http://securityfocus.com/archive/1/491024/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1816 · Security Note
• http://vupen.com/english/advisories/2008/1233/references · Vendor Advisory
• http://secunia.com/advisories/29829 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1267/references · Vendor Advisory
• http://secunia.com/advisories/29874 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1816 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42000 · Note
• http://red-database-security.com/advisory/oracle_sql_injection_sdo_util.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41858 · Note
• http://securitytracker.com/id?1019855 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2008-082075.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41999 · Note
• http://securityfocus.com/archive/1/490918/100/0/threaded · Note