• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: Oracle 10g DBMS_EXPORT_EXTENSION SQL Injection Vulnerability

Severity: HIGH

Description:

Oracle 10g products are prone to an SQL-injection vulnerability. This issue exists in the 'GET_DOMAIN_INDEX_METADATA' function of the 'DBMS_EXPORT_EXTENSION' package. Due to improper input validation, a remote attacker with access to the database can elevate their privilege level to those of the DBA.

This vulnerability was initially thought to have been fixed as part of the Oracle April 2006 Security Update (BID 17590), but this issue reportedly wasn't patched.

Further information indicates that this issue also affects the 'GET_DOMAIN_INDEX_TABLES' and "GET_V2_DOMAIN_INDEX_TABLES' functions.

Affected Products:

• Oracle Oracle10g Application Server 10.1.0 .0.2
• Oracle Oracle10g Application Server 10.1.0 .0.3
• Oracle Oracle10g Application Server 10.1.0 .0.3.1
• Oracle Oracle10g Application Server 10.1.0 .0.4
• Oracle Oracle10g Application Server 10.1.2
• Oracle Oracle10g Application Server 10.1.2 .0.1
• Oracle Oracle10g Application Server 10.1.2 .0.2
• Oracle Oracle10g Application Server 10.1.2 .1.0
• Oracle Oracle10g Application Server 10.1.3 .0.0
• Oracle Oracle10g Application Server 9.0.4 .1
• Oracle Oracle10g Application Server 9.0.4 .2
• Oracle Oracle10g Application Server 9.0.4.0
• Oracle Oracle10g Enterprise Edition 10.1.0 .0.2
• Oracle Oracle10g Enterprise Edition 10.1.0 .0.3
• Oracle Oracle10g Enterprise Edition 10.1.0 .0.3.1
• Oracle Oracle10g Enterprise Edition 10.1.0 .0.4
• Oracle Oracle10g Enterprise Edition 10.2.0 .1
• Oracle Oracle10g Enterprise Edition 10.2.0 .2
• Oracle Oracle10g Enterprise Edition 10.2.0 .3
• Oracle Oracle10g Enterprise Edition 9.0.4 .0
• Oracle Oracle10g Personal Edition 10.1.0 .0.2
• Oracle Oracle10g Personal Edition 10.1.0 .0.3
• Oracle Oracle10g Personal Edition 10.1.0 .0.3.1
• Oracle Oracle10g Personal Edition 10.1.0 .0.4
• Oracle Oracle10g Personal Edition 10.2.0 .1
• Oracle Oracle10g Personal Edition 10.2.0 .2
• Oracle Oracle10g Personal Edition 10.2.0 .3
• Oracle Oracle10g Personal Edition 9.0.4 .0
• Oracle Oracle10g Standard Edition 10.1.0 .0.2
• Oracle Oracle10g Standard Edition 10.1.0 .0.3
• Oracle Oracle10g Standard Edition 10.1.0 .0.3.1
• Oracle Oracle10g Standard Edition 10.1.0 .0.4
• Oracle Oracle10g Standard Edition 10.1.0 .0.5
• Oracle Oracle10g Standard Edition 10.1.0 .4.2
• Oracle Oracle10g Standard Edition 10.2.0 .2
• Oracle Oracle10g Standard Edition 10.2.0 .3
• Oracle Oracle10g Standard Edition 10.2.0.1
• Oracle Oracle10g Standard Edition 9.0.4 .0

References:

• Oracle: Oracle Critical Patch Update - July 2006

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.