|
|
| |
| Updates, deletes and inserts are possible with least-privilege via inline views. A user with create session only can insert/update/delete data (e.g. the dual table). This bug is similar but not identical to the bug which was fixed in the July 2006 CPU (Modify Data via views). No workarounds available. |
| |
Credit:
The information has been provided by Alexander Kornbrust.
The original article can be found at: http://www.red-database-security.com/advisory/oracle_modify_data_via_inline_views.html
|
| |
Samples:
delete from (specially crafted inline view)
insert into (specially crafted inline view)
update (specially crafted inline view)
Patch Information:
Apply the patches for Oracle CPU October 2006.
History:
24-jul-2006 Oracle secalert was informed about a variant of the create view bug.
18-oct-2006 Oracle published CPU October 2006 [DB09]
18-oct-2006 Advisory published
CVE Information:
CVE-2006-5337
|
|
|
|
|
|
|
|
