Published: 18/07/2007 Updated: 15/10/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 660

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17). NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle database server 10.2.0.3
oracle database server 9.0.1.5
oracle database server 10.1.0.5
oracle database server 9.2.0.8
oracle database server 9.2.0.8dv

Oracle 9i and 10g evil view change password exploit ...

source: wwwsecurityfocuscom/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases Earlier unsupported releases are likely to be affected by these issues as well The issues identified by the vendor affect all security properties of the Oracle products ...

-- -- bunkerviewsql -- -- Oracle 9i/10g - evil view exploit (CVE-2007-3855) -- Uses evil view to perform unauthorized password update -- -- by Andrea "bunker" Purificato - rawlabmindcreationscom -- 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 -- -- This code should be used only for LEGAL purpose! -- and remember: use Oracle at y ...

NVD-CWE-Other http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html http://www.red-database-security.com/advisory/oracle_view_vulnerability.html http://secunia.com/advisories/26114 http://rawlab.mindcreations.com/codes/exp/oracle/bunkerview.sql http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf http://www.us-cert.gov/cas/techalerts/TA07-200A.html http://www.securitytracker.com/id?1018415 http://secunia.com/advisories/26166 http://securityreason.com/securityalert/2903 http://www.vupen.com/english/advisories/2007/2562 http://www.vupen.com/english/advisories/2007/2635 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html https://exchange.xforce.ibmcloud.com/vulnerabilities/35495 https://exchange.xforce.ibmcloud.com/vulnerabilities/35490 http://www.securityfocus.com/archive/1/474326/100/0/threaded http://www.securityfocus.com/archive/1/473997/100/0/threaded https://nvd.nist.gov https://packetstormsecurity.com/files/57886/bunkerview.txt.html https://www.exploit-db.com/exploits/30295/

CVE-2007-3855

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect