CVE-2006-0586: SQL Injection
Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACHJOB, (2) HASPRIVS, and (3) OPENJOB functions in the SYS.KUPV$FT package; and (4) UPDATEJOB, (5) ACTIVEJOB, (6) ATTACHPOSSIBLE, (7) ATTACHTOJOB, (8) CREATENEWJOB, (9) DELETEJOB, (10) DELETEMASTERTABLE, (11) DETACHJOB, (12) GETJOBINFO, (13) GETJOBQUEUES, (14) GETSOLEJOBNAME, (15) MASTERTBLLOCK, and (16) VALIDHANDLE functions in the SYS.KUPV$FTINT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0586?
CVE-2006-0586 is considered a high severity vulnerability due to the potential for remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2006-0586?
Fix CVE-2006-0586 by applying the appropriate patches provided by Oracle in the CPU January 2006 update.
Which versions of Oracle are affected by CVE-2006-0586?
CVE-2006-0586 affects Oracle 10g Release 1 versions prior to CPU January 2006.
What types of attacks can be executed due to CVE-2006-0586?
Attackers can exploit CVE-2006-0586 to perform SQL injection attacks, allowing them to manipulate database queries.
Is there a workaround for CVE-2006-0586?
While the best solution is to apply the patches, limiting database user permissions may help mitigate the risk of CVE-2006-0586.