Description
Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via a reference to a malicious package in the TYPE_NAME argument in the (1) GET_DOMAIN_INDEX_TABLES or (2) GET_V2_DOMAIN_INDEX_TABLES function in the DBMS_EXPORT_EXTENSION package.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Oracle 9i/10g - DBMS_EXPORT_EXTENSION SQL Injection EDB-3269 · remote · Feb 5, 2007 · verified
- Oracle 10g Release 2 - 'DBMS_EXPORT_EXTENSION' SQL EDB-1719 · local · Apr 26, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060426 Recent Oracle exploit is _actually_ an 0day with no patch mailing-list
- 20060427 Re: Recent Oracle exploit is _actually_ an 0day with no patch mailing-list
- VU#932124 third-party-advisory
- 19860 third-party-advisory
- 17699 vdb-entry
- 20060427 Re: Recent Oracle exploit is _actually_ an 0day with no patch mailing-list