CVE-2006-0551: SQL Injection
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0551?
CVE-2006-0551 is considered a high-severity vulnerability due to its SQL injection risk, which can lead to remote code execution.
How do I fix CVE-2006-0551?
To fix CVE-2006-0551, ensure you apply the latest security patches provided by Oracle for the affected database versions.
Which software versions are affected by CVE-2006-0551?
CVE-2006-0551 affects Oracle Database versions 10.1.0.3, 10.1.0.4, 10.1.0.5, and 10.2.0.1.
Can CVE-2006-0551 be exploited remotely?
Yes, CVE-2006-0551 can be exploited remotely by attackers through the Data Pump Metadata API.
What types of attacks can result from CVE-2006-0551?
CVE-2006-0551 can enable attackers to execute arbitrary SQL commands, leading to data manipulation and unauthorized access.