CVE-2005-4832

Published: 31/12/2005 Updated: 29/07/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 770

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle oracle10g standard 10.2.0.1
oracle oracle10g standard 9.0.4 .0
oracle oracle10g personal 10.1.0.3
oracle oracle10g standard 10.1.0.3.1
oracle oracle10g personal 10.1 .0.2
oracle oracle10g enterprise 10.1.0.4
oracle oracle10g enterprise 10.1.0.3
oracle oracle10g enterprise 10.1.0.3.1
oracle oracle10g standard 10.1.0.2
oracle oracle10g personal 9.0.4.0
oracle oracle10g enterprise 9.0.4.0
oracle oracle10g standard 9.0.4.0
oracle oracle10g personal 9.0.4 .0
oracle oracle10g standard 10.1.0.4
oracle oracle10g personal 10.1.0.3.1
oracle oracle10g standard 10.2.3
oracle oracle10g enterprise 10.2.3
oracle oracle10g personal 10.1.0.2
oracle oracle10g standard 10.1 .0.2
oracle oracle10g standard 10.1.0.3
oracle oracle10g standard 10.1.0.5
oracle oracle10g personal 10.10.3.1
oracle oracle10g enterprise 10.1.0.2
oracle oracle10g personal 10.2.3
oracle oracle10g enterprise 9.0.4 .0
oracle oracle10g standard 10.1.0.4.2
oracle oracle10g personal 10.1.0.4

source: wwwsecurityfocuscom/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data The 'SUBSCRIPTION_NAME' parameter is vulnerable Packages that employ this parameter execute with 'SYS' user privileges Exploiting the SQL-injection vulnerability can a ...

#!/usr/bin/perl # # Remote Oracle DBMS_CDC_SUBSCRIBEACTIVATE_SUBSCRIPTION exploit (9i/10g) # - Version 2 - New "evil cursor injection" tip! # - No "create procedure" privileg needed! # - See: wwwdatabasesecuritycom/ (Cursor Injection) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise ...

#!/usr/bin/perl # # Remote Oracle DBMS_CDC_SUBSCRIBEACTIVATE_SUBSCRIPTION exploit (9i/10g) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise Edition Release 101030" # # REF: wwwsecurityfocuscom/archive/1/396133 # # AUTHOR: Andrea "bunker" Purificato # rawlab ...

source: wwwsecurityfocuscom/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data The 'SUBSCRIPTION_NAME' parameter is vulnerable Packages that employ this parameter execute with 'SYS' user privileges Exploiting the SQL-injection vulnerability can ...

NVD-CWE-Other http://www.securityfocus.com/archive/1/396133 http://www.securityfocus.com/archive/1/404970 http://www.appsecinc.com/resources/alerts/oracle/2005-02.html http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf http://www.securityfocus.com/bid/13236 https://exchange.xforce.ibmcloud.com/vulnerabilities/20159 https://nvd.nist.gov https://www.exploit-db.com/exploits/25452/

CVE-2005-4832

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect