PT-2009-1222 · Oracle · Oracle Database

Sh2Kerr · Published 2009-01-14 · Updated 2018-10-11 · CVE-2008-3979

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 10.1.0.5 through 10.2.0.2

Description The issue affects confidentiality and integrity, potentially allowing remote authenticated users to gain privileges via unknown vectors. Researchers claim it may be a SQL injection vulnerability, specifically allowing access to MDSYS privileges through the MDSYS.SDO TOPO DROP FTBL trigger.

Recommendations For Oracle Database versions 10.1.0.5 through 10.2.0.2, consider restricting access to the MDSYS.SDO TOPO DROP FTBL trigger as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2008-3979

Affected Products

Oracle Database

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/droptable_trigger.rb · Exploit
• 🔥 https://exploit-db.com/exploits/8074 · Exploit
• http://vupen.com/english/advisories/2009/0115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3979 · Security Note
• http://secunia.com/advisories/33525 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3979 · Note
• http://securityfocus.com/bid/33177 · Note
• http://osvdb.org/51354 · Note
• http://securitytracker.com/id?1021561 · Note
• http://securityfocus.com/archive/1/500061/100/0/threaded · Note
• http://oracle.com/technetwork/topics/security/cpujan2009-097901.html · Note