Published: 10/08/2012 Updated: 11/10/2013

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMS_STATS.GATHER_TABLE_STATS.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle database server 11.2.0.2
oracle database server 11.2.0.3
oracle database server 10.2.0.4
oracle database server 10.2.0.5
oracle database server 11.1.0.7
oracle database server 10.2.0.3

CWE-89 http://www.darkreading.com/database-security/167901020/security/news/240004776/hacking-oracle-database-indexes.html https://blogs.oracle.com/security/entry/security_alert_cve_2012_3132 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-3132-1721017.html http://www.networkworld.com/news/2012/072712-black-hat-shark-bitten-security-researcher-261203.html http://www.teamshatter.com/topics/general/team-shatter-exclusive/ctxsys-context-privilege-escalation/http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html http://www.securitytracker.com/id?1027367 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2012-3132

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect