Vulnerability CVE-2006-0435

Vulnerability CVE-2006-0435

Published: 2006-01-26 Modified: 2012-02-12

Description:

Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	The History of the Oracle PLSQL Gateway Flaw	David Litchfield	03.02.2006
Med.	More on the workaround for the unpatched Oracle PLSQL Gateway flaw	David Litchfield	03.02.2006

Type:

CWE-noinfo

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Oracle -> Application server
Oracle -> Http server

References:

http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041898.html

http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041899.html

http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041742.html

http://securityreason.com/securityalert/402

http://securityreason.com/securityalert/403

http://securitytracker.com/id?1015544

http://securitytracker.com/id?1015961

http://www.kb.cert.org/vuls/id/169164

http://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html

http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.html

http://www.securityfocus.com/archive/1/423029/100/0/threaded

http://www.securityfocus.com/archive/1/423673/100/0/threaded

http://www.securityfocus.com/archive/1/423819/100/0/threaded

http://www.securityfocus.com/archive/1/423822/100/0/threaded

http://www.securityfocus.com/archive/1/424394/100/0/threaded

http://www.securityfocus.com/archive/1/432267/100/0/threaded

http://www.securityfocus.com/bid/16384

http://www.vupen.com/english/advisories/2006/0338

http://www.vupen.com/english/advisories/2006/1397

http://www.vupen.com/english/advisories/2006/1571

https://exchange.xforce.ibmcloud.com/vulnerabilities/24363

Vulnerability CVE-2006-0435

See advisories in our WLB2 database:

Med.

The History of the Oracle PLSQL Gateway Flaw

Med.

More on the workaround for the unpatched Oracle PLSQL Gateway flaw

CWE-noinfo

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

7.5/10

6.4/10

10/10

Remote

Low

No required

Partial

Partial

Partial

Affected software

References: