Description
Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3984.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE
auxiliary/sqli/oracle/lt_mergeworkspace
Exploit-DB 1
- Oracle 10g - SYS.LT.MERGEWORKSPACE SQL Injection EDB-7676 · local · Jan 6, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html
- 32291 third-party-advisory
- oracle-database-workspace-priv-escalation2(45886) vdb-entry
- 1021050 vdb-entry
- ADV-2008-2825 vdb-entry