PT-2009-3559 · Oracle · Oracle Database

Franz Hüll · Published 2009-04-15 · Updated 2018-10-10 · CVE-2009-0977

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.8 through 9.2.0.8DV Oracle Database versions 10.1.0.5 Oracle Database versions 10.2.0.3

Description The issue affects the Advanced Queuing component and is related to DBMS AQIN. It may allow remote authenticated users to impact confidentiality and integrity. There are claims that this issue could be related to SQL injection in the GRANT TYPE ACCESS procedure within the DBMS AQADM SYS package.

Recommendations For Oracle Database version 9.2.0.8, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 9.2.0.8DV, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 10.1.0.5, consider restricting access to the Advanced Queuing component until a fix is available. For Oracle Database version 10.2.0.3, consider restricting access to the Advanced Queuing component until a fix is available. As a temporary workaround, consider disabling the GRANT TYPE ACCESS procedure in the DBMS AQADM SYS package to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2009-0977

Affected Products

Oracle Database

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-0977 · Security Note
• http://securityfocus.com/archive/1/502727/100/0/threaded · Note
• http://securityfocus.com/bid/34461 · Note
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0977 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Note
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_aqadm_sys.html · Note
• http://secunia.com/advisories/34693 · Note
• http://securitytracker.com/id?1022052 · Note