|
Brought to you by:
Suppliers of:
|
|
|
| |
| The SUBSCRIPTION_NAME parameter -- used in various procedures of SYS.DBMS_CDC_SUBSCRIBE and SYS.DBMS_CDC_ISUBSCRIBE packages -- is vulnerable to SQL injection. These packages execute with privileges of the SYS user; by default, PUBLIC has EXECUTE privilege. |
| |
Credit:
The information has been provided by Team SHATTER.
The original article can be found at: http://www.appsecinc.com/resources/alerts/oracle/2005-02.html
|
| |
Vulnerable Systems:
* Oracle Database Server version 10g
Impact:
Any low privileged database user can execute functions with DBA privileges. Users with privileges to create or modify a function can inject a user-defined function in the vulnerable procedure and thus execute SQL statements with DBA privileges.
Workaround:
Revoke Execute privilege on the vulnerable packages.
Vendor Status:
Vendor was contacted and a patch was released.
Fix:
Apply Oracle Critical Patch Update April 2005 available at: http://metalink.oracle.com, http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
|
|
|
|
|
