CVE-2006-5342: SQL Injection

Published Oct 18, 2006

Updated

Unspecified vulnerability in Oracle Spatial component in Oracle Database 9.0.1.5, 9.2.0.6, and 10.1.0.3 has unknown impact and remote authenticated attack vectors related to mdsys.sdotune, aka Vuln# DB18. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB18 might be related to SQL injection in the EXTENTOF function.

Affected Software

3 affected components

Oracle Database Server=10.1.0.3

Oracle Database Server=9.0.1.5

Oracle Database Server=9.2.0.6

Remediation

Patch Available

http://www.securityfocus.com/bid/20588

Event History

Oct 18, 2006

CVE Published

01:07 AM

Data Sourced

via NVD·01:07 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5342?

The severity of CVE-2006-5342 is currently unknown due to unspecified impact details.

How do I fix CVE-2006-5342?

The recommended fix for CVE-2006-5342 is to apply the latest security patches provided by Oracle for affected database versions.

Which versions of Oracle Database are affected by CVE-2006-5342?

CVE-2006-5342 affects Oracle Database versions 9.0.1.5, 9.2.0.6, and 10.1.0.3.

Can CVE-2006-5342 be exploited remotely?

Yes, CVE-2006-5342 has remote authenticated attack vectors that could potentially be exploited.

What component of Oracle is impacted by CVE-2006-5342?

CVE-2006-5342 impacts the Oracle Spatial component in the Oracle Database.