CVE-2005-1496: Medium severity Oracle Application Server vulnerability
Published May 11, 2005
·Updated
The DBMSScheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSIONUSER to the SYS user.
Affected Software
12 affected components
Oracle Application Server=10.1.0.2
Oracle Application Server=10.1.0.3
Oracle Application Server=10.1.0.3.1
Oracle Oracle10g=enterprise_10.1.0.2
Oracle Oracle10g=enterprise_10.1.0.3
Oracle Oracle10g=enterprise_10.1.0.3.1
Oracle Oracle10g=personal_10.1.0.2
Oracle Oracle10g=personal_10.1.0.3
Oracle Oracle10g=personal_10.1.0.3.1
Oracle Oracle10g=standard_10.1.0.2
Oracle Oracle10g=standard_10.1.0.3
Oracle Oracle10g=standard_10.1.0.3.1
Remediation
Event History
May 11, 2005
CVE Published
04:00 AM
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-1496?
CVE-2005-1496 has a high severity rating due to the potential for unauthorized privilege escalation.
2
How do I fix CVE-2005-1496?
To resolve CVE-2005-1496, ensure that appropriate privileges are restricted for the CREATE JOB function in DBMS_Scheduler.
3
What versions of Oracle are affected by CVE-2005-1496?
CVE-2005-1496 affects various versions of Oracle 10g, specifically 10.1.0.2 and 10.1.0.3 across several configurations.
4
Can CVE-2005-1496 be exploited remotely?
Yes, CVE-2005-1496 can be exploited remotely by attackers who have CREATE JOB privileges.
5
What consequences can arise from CVE-2005-1496 exploitation?
Exploitation of CVE-2005-1496 may allow attackers to change their session user to SYS, gaining unauthorized access to sensitive database resources.