CVE-2004-1339: SQL Injection

Published Dec 23, 2004

Updated

SQL injection vulnerability in the (1) MDSYS.SDOGEOMTRIGINS1 and (2) MDSYS.SDOLRSTRIGINS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.tablename or new.columnname parameters.

Affected Software

14 affected components

Oracle Oracle9i=9.0.2.2

Oracle Oracle9i=9.0.1

Oracle Oracle9i=9.0.2

Oracle Oracle9i=9.0

Oracle Oracle9i=9.2.0.1

Oracle Oracle9i=9.2.0.2

Oracle Oracle9i=9.0.1.3

Oracle Oracle9i=9.0.1.2

Oracle Oracle9i=9.0.2.0.0

Oracle Oracle9i=9.0.2.1

Oracle Oracle9i=9.0.2.3

Oracle Database Server=10.2.1-r2

Oracle Oracle9i=9.0.1.4

Oracle Oracle9i=9.0.2.0.1

Remediation

Patch Available

http://www.ngssoftware.com/advisories/oracle23122004I.txt

Event History

Dec 23, 2004

CVE Published

05:00 AM

Jan 6, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1339?

CVE-2004-1339 has a high severity level due to its potential to allow remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2004-1339?

To fix CVE-2004-1339, it is recommended to apply the latest security patches provided by Oracle for affected versions.

Which versions are affected by CVE-2004-1339?

CVE-2004-1339 affects Oracle Database versions 9i and 10g, specifically various releases within those versions.

What types of attacks are possible with CVE-2004-1339?

CVE-2004-1339 could enable attackers to perform SQL injection attacks, potentially compromising the database.

Is CVE-2004-1339 a remote attack vulnerability?

Yes, CVE-2004-1339 can be exploited by remote attackers to execute SQL commands on the targeted database.