Description
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17). NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Oracle 9i/10g - Evil Views Change Passwords EDB-4203 · local · Jul 19, 2007 · verified
- Oracle Database - SQL Compiler Views Unauthorized Manipulation EDB-30295 · local · Jul 12, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- SSRT061201 vendor-advisory
- 26114 third-party-advisory
- 26166 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
- TA07-200A third-party-advisory
- 2903 third-party-advisory
- http://rawlab.mindcreations.com/codes/exp/oracle/bunkerview.sql
- ADV-2007-2562 vdb-entry
- ADV-2007-2635 vdb-entry
- oracle-unauth-view-access(35495) vdb-entry
- http://www.red-database-security.com/advisory/oracle_view_vulnerability.html
- 20070721 Oracle bad Views - Exploit released mailing-list
- oracle-cpu-july2007(35490) vdb-entry
- http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
- 1018415 vdb-entry
- 20070718 Oracle Security: Insert / Update / Delete Data via Views mailing-list
- http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html