CVE-2006-5332

Severity

90%

Complexity

80%

Confidentiality

165%

Unspecified vulnerability in xdb.dbms_xdbz in the XMLDB component for Oracle Database 9.2.0.6 and 10.1.0.4 has unknown impact and remote authenticated attack vectors, aka Vuln# DB01. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB01 is for PL/SQL injection in the ENABLE_HIERARCHY_INTERNAL procedure.

Unspecified vulnerability in xdb.dbms_xdbz in the XMLDB component for Oracle Database 9.2.0.6 and 10.1.0.4 has unknown impact and remote authenticated attack vectors, aka Vuln# DB01. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB01 is for PL/SQL injection in the ENABLE_HIERARCHY_INTERNAL procedure.

CVSS 2.0 Base Score 9. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C).

Overview

First reported 18 years ago

2006-10-18 01:07:00

Last updated 6 years ago

2018-10-17 21:42:00

Affected Software

Oracle Database Server 9.2.0.6

9.2.0.6

Oracle Database Server 10g 10.1.0.4

10.1.0.4

References

22396

Vendor Advisory

1017077

http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf

VU#717140

US Government Resource

http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html

http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html

http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_xdbz0.html

20061018 Analysis of the Oracle October 2006 Critical Patch Update

20061023 SQL Injection in package XDB.DBMS_XDBZ0

HPSBMA02133

20588

Patch

TA06-291A

US Government Resource

ADV-2006-4065

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.