CVE-2004-1338: Medium severity Oracle Oracle9i vulnerability

Published Dec 23, 2004

Updated

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXECCBKFNDML to add arbitrary functions to the SDOCMTDBKFNTABLE and SDOCMTCBKDMLTABLE, then performing a DELETE on the SDOTXNIDXINSERTS table, which causes the SDOCMTCBKTRIG trigger to execute the user-supplied functions.

Affected Software

14 affected components

Oracle Oracle9i=9.0.2.2

Oracle Oracle9i=9.0.1

Oracle Oracle9i=9.0.2

Oracle Oracle9i=9.0

Oracle Oracle9i=9.2.0.1

Oracle Oracle9i=9.2.0.2

Oracle Oracle9i=9.0.1.3

Oracle Oracle9i=9.0.1.2

Oracle Oracle9i=9.0.2.0.0

Oracle Oracle9i=9.0.2.1

Oracle Oracle9i=9.0.2.3

Oracle Database Server=10.2.1-r2

Oracle Oracle9i=9.0.1.4

Oracle Oracle9i=9.0.2.0.1

Remediation

Patch Available

http://www.ngssoftware.com/advisories/oracle23122004I.txt

Event History

Dec 23, 2004

CVE Published

05:00 AM

Jan 6, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1338?

CVE-2004-1338 is considered a critical vulnerability as it allows local users to gain elevated privileges.

How do I fix CVE-2004-1338?

To fix CVE-2004-1338, you should apply the latest security patches provided by Oracle for the affected versions.

What products are affected by CVE-2004-1338?

CVE-2004-1338 affects various versions of Oracle 9i and Oracle Database 10g.

Can CVE-2004-1338 be exploited remotely?

CVE-2004-1338 cannot be exploited remotely as it requires local access to the affected system.

What are the potential impacts of CVE-2004-1338?

The potential impacts of CVE-2004-1338 include unauthorized access to sensitive data and the ability to execute arbitrary functions.