CVE-2006-0271 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2006-0271
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-0271

Description: Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_EXISTS, (5) COMP_PATH, (6) GATHER_STATS, (7) NOTHING_SCRIPT, and (8) VALIDATE_COMPONENTS functions.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/24321 ST 1015499 SAID Secunia Advisory: SA18493 Secunia Advisory: SA18608 OSVDB 22566 MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html CONFIRM http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html CERT-VN 545804 BID 16287

Return to the previous page.