CVE-2006-3698
HIGH 10.0EPSS 7.0%
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.
- CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 6.98% chance of exploitation in the next 30 days, 94th percentile
- Published
- 2006-07-19
- Updated
- 2024-08-07
ExploitDB entries (3)
- https://www.exploit-db.com/exploits/3375
- https://www.exploit-db.com/exploits/3358
- https://www.exploit-db.com/exploits/3178
Security advisories
- http://secunia.com/advisories/21111
- http://secunia.com/advisories/21165
- http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html
- http://www.vupen.com/english/advisories/2006/2863
- http://www.vupen.com/english/advisories/2006/2947
- http://www.securityfocus.com/bid/19054
- http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html