CVE-2006-0549: SQL Injection

Published Feb 4, 2006

Updated

SQL injection vulnerability in the SYS.DBMSMETADATAUTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.

Affected Software

1 affected component

Oracle Database Server=10.1.0.5-r1

Event History

Feb 4, 2006

CVE Published

02:02 AM

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0549?

CVE-2006-0549 has a high severity rating due to the potential for remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2006-0549?

To fix CVE-2006-0549, it is recommended to apply the latest security patches provided by Oracle for affected versions.

Which versions are affected by CVE-2006-0549?

CVE-2006-0549 affects Oracle Database 10g, specifically version 10.1.0.5-r1, and possibly earlier versions.

What type of vulnerability is CVE-2006-0549?

CVE-2006-0549 is classified as an SQL injection vulnerability that allows attackers to manipulate database queries.

Can CVE-2006-0549 be exploited remotely?

Yes, CVE-2006-0549 can be exploited remotely, enabling attackers to execute malicious SQL commands.