1. CVE-Search
  2. CVE-2006-0270
ID CVE-2006-0270
Summary Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27. NOTE: Oracle has not disputed a reliable researcher report that TDA stores the master key without encryption, which allows local users to obtain the key via the SGA.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:database_server:10.2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database_server:10.2.0.1:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 19-10-2018 - 15:43)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 16287
bugtraq 20060117 Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGA
cert-vn VU#545804
confirm http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
misc http://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.html
sectrack 1015499
secunia
  • 18493
  • 18608
vupen
  • ADV-2006-0243
  • ADV-2006-0323
xf
  • oracle-january2006-update(24321)
  • oracle-sga-masterkey-plaintext(24186)
saint via4
bid 16287
description Oracle XML Component DBMS_XMLSCHEMA.GENERATESCHEMA buffer overflow
id database_oracle_version
osvdb 22567
title oracle_xml_generateschema
type remote
Last major update 19-10-2018 - 15:43
Published 18-01-2006 - 11:03
Last modified 19-10-2018 - 15:43
Back to Top