Description
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB21 for Statistics and (2) DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection vulnerability in SYS.DBMS_STATS, and that DB22 is for SQL injection in SYS.DBMS_UPGRADE.
References
- 1016529 vdb-entry
- oracle-dbmsstats-sql-injection(27887) vdb-entry
- http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade.html
- 19054 vdb-entry
- 1251 third-party-advisory
- oracle-cpu-july-2006(27897) vdb-entry
- 21165 third-party-advisory
- HPSBMA02133 vendor-advisory
- ADV-2006-2947 vdb-entry
- http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html
- TA06-200A third-party-advisory
- 21111 third-party-advisory
- 20060718 Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21] mailing-list
- oracle-dbmsupgrade-sql-injection(27886) vdb-entry
- 20060718 Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21] mailing-list
- http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_stats.html
- 20060718 Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22] mailing-list
- http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html
- ADV-2006-2863 vdb-entry
- 20060718 Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22] mailing-list