1. CVE-Search
  2. CVE-2005-1496
ID CVE-2005-1496
Summary The DBMS_Scheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSION_USER to the SYS user. Applying patchset 10.1.0.4 is fixing this issue.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:application_server:10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_server:10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_server:10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 13509
bugtraq 20050505 Oracle 10g DBMS_SCHEDULER SESSION_USER issue
misc http://www.red-database-security.com/exploits/oracle_exploit_dbms_scheduler_select_user.html
xf oracle10g-gain-privileges(20410)
Last major update 11-07-2017 - 01:32
Published 11-05-2005 - 04:00
Last modified 11-07-2017 - 01:32
Back to Top