CVE-2006-5335: SQL Injection

Published Oct 18, 2006

Updated

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) Vuln# DB04 and sys.dbmscdcimpdp in the (a) Change Data Capture (CDC) component; (2) Vuln# DB07, (3) DB08, and (4) DB16 in sys.dbmscdcisubscribe in CDC; and (5) mdsys.sdogeorint in the (b) Oracle Spatial component, aka DB12. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that these issues are related to SQL injection in the BUMPSEQUENCE function (DB04), CREATESUBSCRIPTION (DB07), EXTENDWINDOWLIST (DB08), SUBSCRIBE (DB16), and COMPRESSDATA (DB12).

Affected Software

2 affected components

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.2

Remediation

Patch Available

http://www.securityfocus.com/bid/20588

Event History

Oct 18, 2006

CVE Published

01:07 AM

Data Sourced

via NVD·01:07 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5335?

The severity of CVE-2006-5335 is currently unspecified, but it involves multiple vulnerabilities in Oracle Database versions 10.1.0.5 and 10.2.0.2.

How do I fix CVE-2006-5335?

To address CVE-2006-5335, it is recommended to apply the latest security patches provided by Oracle for the affected database versions.

Which Oracle Database versions are affected by CVE-2006-5335?

CVE-2006-5335 affects Oracle Database versions 10.1.0.5 and 10.2.0.2.

Can CVE-2006-5335 be exploited remotely?

Yes, CVE-2006-5335 has remote authenticated attack vectors.

What components are involved in CVE-2006-5335?

CVE-2006-5335 involves vulnerabilities related to the Change Data Capture (CDC) component in Oracle Database.