Oracle Security: Insert / Update / Delete Data via Views

2007.07.21
Risk: High
Local: Yes
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 6.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Insert / Update / Delete Data via Views ####################################### This advisory <http://www.red-database-security.com/advisory/oracle_view_vulnerability .html> Name Insert / Update / Delete Data via Views [DB17] Systems Oracle 8i - 10g Rel. 2 Severity High Risk Category Bypass Access Control Author Alexander Kornbrust (ak at red-database-security.com) Advisory 17 July 2007 (V 1.00) Details ######## Updates, deletes and inserts are possible via specially crafted views without having the right privileges. This vulnerability is not identical with similar vulnerabilities fixed with April 2006 CPU and October 2006 CPU. Samples ####### delete from (specially crafted view) insert into (specially crafted view) update (specially crafted view) Testcases will be released if we can verify that the problem is really fixed. Patch Information ################# Apply the patches for Oracle CPU July 2007. History ####### 24-oct-2006 Oracle secalert was informed 25-oct-2006 Bug confirmed 18-jul-2007 Oracle published CPU July 2007 [DB17] 18-jul-2007 Advisory published Analysis and CVE entries of the Oracle CPU ########################################### <http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html> (c) 2007 by Red-Database-Security GmbH - last update 17-jul-2007


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top