CVE-2006-0549: SQL Injection
First published: Sat Feb 04 2006(Updated: )
SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Database | =10.1.0.5-r1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf
- http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html
- http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html
- http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_metadata_util.html
- http://www.us-cert.gov/cas/techalerts/TA06-018A.html
- http://www.kb.cert.org/vuls/id/629316
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
Frequently Asked Questions
What is the severity of CVE-2006-0549?
CVE-2006-0549 has a high severity rating due to the potential for remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2006-0549?
To fix CVE-2006-0549, it is recommended to apply the latest security patches provided by Oracle for affected versions.
Which versions are affected by CVE-2006-0549?
CVE-2006-0549 affects Oracle Database 10g, specifically version 10.1.0.5-r1, and possibly earlier versions.
What type of vulnerability is CVE-2006-0549?
CVE-2006-0549 is classified as an SQL injection vulnerability that allows attackers to manipulate database queries.
Can CVE-2006-0549 be exploited remotely?
Yes, CVE-2006-0549 can be exploited remotely, enabling attackers to execute malicious SQL commands.
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/oracle
- canonical/oracle database
- version/oracle database/10.1.0.5-r1