CVE-2008-3979: SQL Injection

Published Jan 14, 2009

Updated

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDOTOPODROPFTBL trigger.

Affected Software

2 affected components

Oracle Database 10g=10.1.0.5

Oracle Database 10g=10.2.0.2

Event History

Jan 14, 2009

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3979?

CVE-2008-3979 is considered to have an unspecified severity level, impacting the confidentiality and integrity of authorized users.

How do I fix CVE-2008-3979?

To fix CVE-2008-3979, you should apply the latest security patches provided by Oracle for affected database versions.

What versions of Oracle Database are affected by CVE-2008-3979?

CVE-2008-3979 affects Oracle Database 10.1.0.5 and 10.2.0.2.

Can CVE-2008-3979 be exploited remotely?

Yes, CVE-2008-3979 can be exploited by remote authenticated users.

What components of Oracle Database are impacted by CVE-2008-3979?

CVE-2008-3979 affects the Oracle Spatial component of the Oracle Database.