PT-2010-2593 · Oracle · Oracle Database

Published 2010-04-13 · Updated 2012-10-23 · CVE-2010-0870

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database version 9.2.0.8 Oracle Database version 9.2.0.8DV

Description The issue affects the confidentiality and integrity of the system, related to the SYS.DBMS CDC PUBLISH function in the Change Data Capture component. It can be exploited by remote authenticated users.

Recommendations For Oracle Database version 9.2.0.8, consider restricting access to the Change Data Capture component until a fix is available. For Oracle Database version 9.2.0.8DV, consider restricting access to the Change Data Capture component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2010-0870

Affected Products

Oracle Database

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/dbms_cdc_publish2.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0870 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0870 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2010-099504.html · Note
• http://secunia.com/advisories/39438 · Note
• http://us-cert.gov/cas/techalerts/TA10-103B.html · Note