CVE-2006-5333: SQL Injection

Published Oct 18, 2006

Updated

Unspecified vulnerability in Oracle Spatial component in Oracle Database 10.2.0.2 has unknown impact and remote authenticated attack vectors related to "create session" privileges, aka Vuln# DB02. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB02 is for SQL injection in the SDODROPUSERBEFORE package using a Trigger for a DROP USER statement in an anonymous PL/SQL block.

Affected Software

1 affected component

Oracle Database Server=10.2.0.2

Remediation

Patch Available

http://www.securityfocus.com/bid/20588

Event History

Oct 18, 2006

CVE Published

01:07 AM

Data Sourced

via NVD·01:07 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5333?

The severity of CVE-2006-5333 is currently unknown due to its unspecified impact.

How do I fix CVE-2006-5333?

To address CVE-2006-5333, it is recommended to apply the latest patches provided by Oracle for Database version 10.2.0.2.

What versions of Oracle Database are affected by CVE-2006-5333?

CVEs related to this issue specifically affect Oracle Database version 10.2.0.2.

Can CVE-2006-5333 be exploited remotely?

Yes, CVE-2006-5333 has remote authenticated attack vectors.

Is there any mitigation for CVE-2006-5333?

Limiting database access permissions and implementing strong access control can serve as mitigations for CVE-2006-5333.