DB: Oracle Database SQL Compiler Access Control Security Bypass

This signature detects attempts to exploit a known security bypass vulnerability in the Oracle Database Server product. Specifically, it is due to improper enforcement of user permissions on data access to tables through certain types of views. A remote authenticated attacker can use this to perform UPDATE, DELETE and INSERT operations without having proper privileges. The data stored in the Oracle Database can be modified, deleted, and inserted by the attacker, thereby compromising the availability and integrity of data.

Extended Description

Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well. The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise.

Affected Products

Oracle oracle10g_personal_edition

References

BugTraq: 24887

CVE: CVE-2007-3855

Short Name

DB:ORACLE:COMPILER-ACL

Severity

Major

Recommended

False

Recommended Action

Drop

DB: Oracle Database SQL Compiler Access Control Security Bypass

Extended Description

Affected Products

References

Found a potential security threat?