CVE-2006-0547

2006-02-0402:02:00

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.02

Percentile

89.0%

JSON

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB18 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0265.

Affected configurations

Nvd

Node

oracledatabase_serverMatch8.1.7.4r3

oracledatabase_serverMatch9.2.0.6r2

oracledatabase_serverMatch9.2.0.7r2

oracledatabase_serverMatch10.1.0.3r1

oracledatabase_serverMatch10.1.0.4r1

oracledatabase_serverMatch10.1.0.5r1

oracledatabase_serverMatch10.2.0.1r2

VendorProductVersionCPE
oracledatabase_server8.1.7.4cpe:2.3:a:oracle:database_server:8.1.7.4:r3:*:*:*:*:*:*
oracledatabase_server9.2.0.6cpe:2.3:a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*
oracledatabase_server9.2.0.7cpe:2.3:a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*
oracledatabase_server10.1.0.3cpe:2.3:a:oracle:database_server:10.1.0.3:r1:*:*:*:*:*:*
oracledatabase_server10.1.0.4cpe:2.3:a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*
oracledatabase_server10.1.0.5cpe:2.3:a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*
oracledatabase_server10.2.0.1cpe:2.3:a:oracle:database_server:10.2.0.1:r2:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	8.1.7.4	cpe:2.3:a:oracle:database_server:8.1.7.4:r3::::::
oracle	database_server	9.2.0.6	cpe:2.3:a:oracle:database_server:9.2.0.6:r2::::::
oracle	database_server	9.2.0.7	cpe:2.3:a:oracle:database_server:9.2.0.7:r2::::::
oracle	database_server	10.1.0.3	cpe:2.3:a:oracle:database_server:10.1.0.3:r1::::::
oracle	database_server	10.1.0.4	cpe:2.3:a:oracle:database_server:10.1.0.4:r1::::::
oracle	database_server	10.1.0.5	cpe:2.3:a:oracle:database_server:10.1.0.5:r1::::::
oracle	database_server	10.2.0.1	cpe:2.3:a:oracle:database_server:10.2.0.1:r2::::::