CVE-2006-0257: SQL Injection

Published Jan 18, 2006

Updated

Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDCALLOCATELOCK function of the DBMSCDCUTILITY package.

Affected Software

3 affected components

Oracle Database Server=9.2.0.7

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.1

Remediation

Patch Available

http://securitytracker.com/id?1015499

Event History

Jan 18, 2006

CVE Published

11:03 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0257?

The severity of CVE-2006-0257 is currently unspecified, as detailed impact and attack vectors are not publicly disclosed.

How do I fix CVE-2006-0257?

To address CVE-2006-0257, it is recommended to apply any available patches or updates for the affected versions of Oracle Database.

What versions of Oracle Database are affected by CVE-2006-0257?

CVE-2006-0257 affects Oracle Database versions 9.2.0.7, 10.1.0.5, and 10.2.0.1.

Is there a known exploit for CVE-2006-0257?

As of the latest information, there is no publicly available exploit specifically described for CVE-2006-0257.

What component of Oracle Database is affected by CVE-2006-0257?

CVE-2006-0257 impacts the Change Data Capture component of Oracle Database.