Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-3698

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2006-3698
Last Modified 22 Oct 2012 10:07:53
Published 21 Jul 2006 10:03:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2006-3698

Summary

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.

Vulnerable Systems

Application

  • Oracle Database Server 10.1.0.5


References

CERT - TA06-200A

BID - 19054

MISC - http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html

CONFIRM - http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html

XF - oracle-cpu-july-2006(27897)

XF - oracle-dbmscdcimpdp-sql-injection(27889)

XF - oracle-kupwworker-sql-injection(27888)

VUPEN - ADV-2006-2947

VUPEN - ADV-2006-2863

HP - SSRT061201

BUGTRAQ - 20060718 Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01]

BUGTRAQ - 20060718 Oracle Database - SQL Injection in SYS.KUPW$WORKER [DB03]

MISC - http://www.red-database-security.com/advisory/oracle_sql_injection_kupw$worker.html

MISC - http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_cdc_impdp.html

SECTRACK - 1016529

SECUNIA - 21165

SECUNIA - 21111

CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html

HP - HPSBMA02133


Last Updated: 27 May 2016 10:51:47