Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-3705

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2006-3705
Last Modified 22 Oct 2012 10:07:54
Published 21 Jul 2006 10:03:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2006-3705

Summary

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB21 for Statistics and (2) DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection vulnerability in SYS.DBMS_STATS, and that DB22 is for SQL injection in SYS.DBMS_UPGRADE.

Vulnerable Systems

Application

  • Oracle Database Server 10.1.0.5


References

CERT - TA06-200A

BID - 19054

MISC - http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html

CONFIRM - http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html

XF - oracle-cpu-july-2006(27897)

XF - oracle-dbmsstats-sql-injection(27887)

XF - oracle-dbmsupgrade-sql-injection(27886)

VUPEN - ADV-2006-2947

VUPEN - ADV-2006-2863

HP - HPSBMA02133

BUGTRAQ - 20060718 Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21]

BUGTRAQ - 20060718 Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22]

MISC - http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade.html

MISC - http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_stats.html

SECTRACK - 1016529

SREASON - 1251

SECUNIA - 21165

SECUNIA - 21111

CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html

HP - SSRT061201


Last Updated: 27 May 2016 10:53:42