CVE-2008-6065: Medium severity Oracle Database Server vulnerability

Published Feb 5, 2009

Updated

Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory, and then overwriting the password file through UTLFILE operations, a related issue to CVE-2006-7141.

Affected Software

3 affected components

Oracle Database Server=10.1

Oracle Database Server=10.2

Oracle Database Server=11

Event History

Feb 5, 2009

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6065?

CVE-2008-6065 is considered a high severity vulnerability due to the potential for remote authenticated users to gain SYSDBA privileges.

How do I fix CVE-2008-6065?

To fix CVE-2008-6065, restrict the CREATE ANY DIRECTORY privilege for users and update to the latest Oracle Database version with security patches.

Which versions of Oracle Database are affected by CVE-2008-6065?

CVE-2008-6065 affects Oracle Database Server versions 10.1, 10.2, and 11g.

Can remote users exploit CVE-2008-6065?

Yes, remote authenticated users with CREATE ANY DIRECTORY privileges can exploit CVE-2008-6065 to gain elevated access.

What impact does CVE-2008-6065 have on database security?

CVE-2008-6065 significantly impacts database security by allowing unauthorized access to SYSDBA privileges through manipulated directory permissions.