CVE-2006-5336: SQL Injection

Published Oct 18, 2006

Updated

Multiple unspecified vulnerabilities in the Change Data Capture (CDC) component in Oracle Database 9.2.0.7, 10.1.0.5, and have unknown impact and remote authenticated attack vectors related to (1) sys.dbmscdcipublish (Vuln# DB05) and (2) sys.dbmscdcisubscribe (DB06). NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB05 is for SQL injection in CREATECHANGETABLE and CHANGETABLETRIGGER, and DB06 is for PL/SQL injection in the PREPAREUNBOUNDEDVIEW procedure.

Affected Software

3 affected components

Oracle Database Server=9.2.0.7

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.2

Remediation

Patch Available

http://www.securityfocus.com/bid/20588

Event History

Oct 18, 2006

CVE Published

01:07 AM

Data Sourced

via NVD·01:07 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5336?

The severity of CVE-2006-5336 is currently unknown due to unspecified vulnerabilities affecting Oracle Database components.

How do I fix CVE-2006-5336?

To fix CVE-2006-5336, apply the latest security patches provided by Oracle for affected database versions.

Which versions are affected by CVE-2006-5336?

CVE-2006-5336 affects Oracle Database versions 9.2.0.7, 10.1.0.5, and also includes 10.2.0.2.

What types of attacks are possible with CVE-2006-5336?

CVE-2006-5336 could potentially allow remote authenticated attackers to exploit vulnerabilities in the Change Data Capture component.

What components are related to CVE-2006-5336?

CVE-2006-5336 is related to the sys.dbms_cdc_ipublish and sys.dbms_cdc_isubscribe components in Oracle Database.