Description
The XML DB (XMLDB) component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which (1) long usernames are trimmed to 5 characters, or (2) short entries contain any extra characters from usernames in previous entries, aka DB23.
References
- http://www.oracle.com/technetwork/topics/security/cpuoct2007-092913.html
- 26107 vdb-entry
- 20071017 Oracle audit issue with XMLDB ftp service mailing-list
- 3247 third-party-advisory
- ADV-2007-3524 vdb-entry
- ADV-2007-3626 vdb-entry
- TA07-290A third-party-advisory
- SSRT061201 vendor-advisory
- http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-xmldb-ftp-service/
- 1018823 vdb-entry
- 27409 third-party-advisory
- 27251 third-party-advisory