CVE-2008-6065
First published: Thu Feb 05 2009(Updated: )
Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory, and then overwriting the password file through UTL_FILE operations, a related issue to CVE-2006-7141.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Database | =10.1 | |
| Oracle Database | =10.2 | |
| Oracle Database | =11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/31738
- http://www.oracleforensics.com/wordpress/index.php/2008/10/10/create-any-directory-to-sysdba/
- http://www.oracleforensics.com/wordpress/wp-content/uploads/2008/10/create-any-directory-to-sysdba.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48814
- http://www.securityfocus.com/archive/1/497286/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-6065?
CVE-2008-6065 is considered a high severity vulnerability due to the potential for remote authenticated users to gain SYSDBA privileges.
How do I fix CVE-2008-6065?
To fix CVE-2008-6065, restrict the CREATE ANY DIRECTORY privilege for users and update to the latest Oracle Database version with security patches.
Which versions of Oracle Database are affected by CVE-2008-6065?
CVE-2008-6065 affects Oracle Database Server versions 10.1, 10.2, and 11g.
Can remote users exploit CVE-2008-6065?
Yes, remote authenticated users with CREATE ANY DIRECTORY privileges can exploit CVE-2008-6065 to gain elevated access.
What impact does CVE-2008-6065 have on database security?
CVE-2008-6065 significantly impacts database security by allowing unauthorized access to SYSDBA privileges through manipulated directory permissions.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/oracle
- canonical/oracle database
- version/oracle database/10.1
- version/oracle database/10.2
- version/oracle database/11