DB: Oracle XML SCHEMA Overflow

This signature detects attempts to exploit a known vulnerability in the Oracle Database Server product. It is due to insufficient validation of the arguments supplied to DBMS_XMLSCHEMA packages. in a successful attack, a remote attacker with valid user credentials can exploit this to execute arbitrary code with database server process privileges.

Extended Description

Various Oracle products -- Oracle Database Server, Oracle Enterprise Manager, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite, PeopleSoft Enterprise Portal, JD Edwards EnterpriseOne Tools, OneWorld Tools, Oracle Developer Suite, and Oracle Workflow -- are prone to multiple vulnerabilities. The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Oracle has released a Critical Patch Update advisory for January 2006 to address these vulnerabilities. This Critical Patch Update addresses the vulnerabilities for supported releases. Earlier, unsupported releases are likely to be affected by the issues as well.

Affected Products

Oracle oracle10g_application_server

References

BugTraq: 16287

CVE: CVE-2006-0272

URL: http://www.argeniss.com/research/ARGENISS-ADV-010601.txt http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html

Short Name

DB:ORACLE:XML-SCHEMA-OF

Severity

Major

Recommended

False

Recommended Action

Drop

DB: Oracle XML SCHEMA Overflow

Extended Description

Affected Products

References

Found a potential security threat?