David Litchfield has reported a vulnerability in Oracle Database, which can be exploited by malicious users to conduct SQL injection attacks.

The vulnerability is caused due to an unspecified input validation error in the "DBMS_EXPORT_EXTENSION" package. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability has been reported in Oracle Database 10g Release 2 with the April 2006 Critical Patch Update. Other versions may also be affected.

Solution
Apply patches (see vendor advisory).

Provided and/or discovered by
David Litchfield

Changelog
Further details available to Secunia VIM customers

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html

David Litchfield:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045540.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers