CVE-2006-1874 - Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact

CVE-2006-1874

Summary

Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB09. NOTE: Oracle has not disputed reliable claims that this issue is SQL injection in MDSYS.PRVT_IDX using the (1) EXECUTE_INSERT, (2) EXECUTE_DELETE, (3) EXECUTE_UPDATE, (4) EXECUTE UPDATE, and (5) CRT_DUMMY functions. Apply patches.

References

Vulnerable Configurations

cpe:2.3:a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.0.6:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 18-10-2018 - 16:37)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	17590
confirm	http://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html
hp	HPSBMA02113 SSRT061148
misc	http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html
sectrack	1015961
secunia	19712 19859
vupen	ADV-2006-1397 ADV-2006-1571
xf	oracle-prvtidx-sql-injection(26053)

Last major update

18-10-2018 - 16:37

Published

20-04-2006 - 10:02

Last modified

18-10-2018 - 16:37