CVE-2006-0551: SQL Injection
First published: Sat Feb 04 2006(Updated: )
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Database | =10.1.0.3 | |
| Oracle Database | =10.1.0.4 | |
| Oracle Database | =10.1.0.5 | |
| Oracle Database | =10.2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf
- http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html
- http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html
- http://www.us-cert.gov/cas/techalerts/TA06-018A.html
- http://www.kb.cert.org/vuls/id/983340
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
Frequently Asked Questions
What is the severity of CVE-2006-0551?
CVE-2006-0551 is considered a high-severity vulnerability due to its SQL injection risk, which can lead to remote code execution.
How do I fix CVE-2006-0551?
To fix CVE-2006-0551, ensure you apply the latest security patches provided by Oracle for the affected database versions.
Which software versions are affected by CVE-2006-0551?
CVE-2006-0551 affects Oracle Database versions 10.1.0.3, 10.1.0.4, 10.1.0.5, and 10.2.0.1.
Can CVE-2006-0551 be exploited remotely?
Yes, CVE-2006-0551 can be exploited remotely by attackers through the Data Pump Metadata API.
What types of attacks can result from CVE-2006-0551?
CVE-2006-0551 can enable attackers to execute arbitrary SQL commands, leading to data manipulation and unauthorized access.
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/oracle
- canonical/oracle database
- version/oracle database/10.1.0.3
- version/oracle database/10.1.0.4
- version/oracle database/10.1.0.5
- version/oracle database/10.2.0.1