Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have...

Vulnerability Description

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) Vuln# DB04 and sys.dbms_cdc_impdp in the (a) Change Data Capture (CDC) component; (2) Vuln# DB07, (3) DB08, and (4) DB16 in sys.dbms_cdc_isubscribe in CDC; and (5) mdsys.sdo_geor_int in the (b) Oracle Spatial component, aka DB12. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that these issues are related to SQL injection in the BUMP_SEQUENCE function (DB04), CREATE_SUBSCRIPTION (DB07), EXTEND_WINDOW_LIST (DB08), SUBSCRIBE (DB16), and COMPRESSDATA (DB12).

References

• http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html
• http://www.securityfocus.com/bid/20588
• http://www.kb.cert.org/vuls/id/736324
• http://www.securityfocus.com/archive/1/449711/100/0/threaded
• http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html
• http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf
• http://www.securityfocus.com/archive/1/449511/100/100/threaded
• http://www.securityfocus.com/archive/1/449110/100/0/threaded
• http://www.securityfocus.com/archive/1/449711/100/0/threaded
• http://www.vupen.com/english/advisories/2006/4065
• http://secunia.com/advisories/22396
• http://securitytracker.com/id?1017077
• http://www.us-cert.gov/cas/techalerts/TA06-291A.html