ID CVE-2005-4832
Summary SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4_.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4_.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:enterprise_10.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:enterprise_10.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_9.0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_9.0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_9.0.4_.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_9.0.4_.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.1_.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.1_.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:personal_10.10.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:personal_10.10.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_9.0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_9.0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_9.0.4_.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_9.0.4_.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.1_.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.1_.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle10g:standard_10.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle10g:standard_10.2.3:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 29-07-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 13236
bugtraq
  • 20050418 [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE packages
  • 20050711 Re: Problems with the Oracle Critical Patch Update for April 2005
confirm http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
misc
xf oracle-subscriptionname-sql-injection(20159)
Last major update 29-07-2017 - 01:29
Published 31-12-2005 - 05:00
Last modified 29-07-2017 - 01:29
Back to Top