CVE-2009-0992: SQL Injection

Published Apr 15, 2009

Updated

Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to DBMSAQIN. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is SQL injection in the DEQEXEJOB procedure.

Affected Software

3 affected components

Oracle Database 10g=10.1.0.5

Oracle Database 10g=10.2.0.4

Oracle Database 11g=11.1.0.7

Event History

Apr 15, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2009-0992?

CVE-2009-0992 is considered a moderate severity vulnerability affecting Oracle Database.

What versions of Oracle Database are affected by CVE-2009-0992?

CVE-2009-0992 affects Oracle Database versions 10.1.0.5, 10.2.0.4, and 11.1.0.7.

How do I fix CVE-2009-0992?

To resolve CVE-2009-0992, it is recommended to apply the latest security patches from Oracle.

What type of vulnerability is CVE-2009-0992?

CVE-2009-0992 is an unspecified vulnerability in the Advanced Queuing component of Oracle Database.

Can CVE-2009-0992 be exploited remotely?

Yes, CVE-2009-0992 can be exploited by remote authenticated users impacting confidentiality and integrity.