This site is deprecated. Please
CLICK HERE for latest updates
Short Name |
DB:ORACLE:DBMS:OUTPUT-TO-JAVA
|
Severity |
Critical
|
Recommended |
No
|
Recommended Action |
Drop
|
Category |
DB
|
Keywords |
Oracle Database DBMS_JAVA.SET_OUTPUT_TO_JAVA Privilege Escalation
|
Release Date |
2012/11/12
|
Update Number |
2202
|
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+
|
DB: Oracle Database DBMS_JAVA.SET_OUTPUT_TO_JAVA Privilege Escalation
This signature detects attempts to exploit a known flaw in Oracle. A vulnerability exists in Oracle Database 11g server that could allow users with limited privileges to execute SQL commands with SYS privileges on the server. The vulnerability is due to an access control weakness that allows non-privileged users to execute methods in the DBMS_JAVA package. Remote authenticated users with only CREATE_SESSION privileges can exploit this vulnerability via the SET_OUTPUT_TO_JAVA method and execute arbitrary SQL commands on the target server.
Extended Description
Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages.
The attacker can exploit these issues to escalate their privileges to DBA or execute arbitrary operating system commands with SYSTEM privileges, leading to a complete compromise of an affected computer.
These vulnerabilities affect Oracle Database 11gR2. One of the issues also affects Oracle Database 10gR2.
Affected Products
- Oracle oracle10g_enterprise_edition 10.1.0 .0.2
- Oracle oracle10g_enterprise_edition 10.1.0 .0.3
- Oracle oracle10g_enterprise_edition 10.1.0 .0.3.1
- Oracle oracle10g_enterprise_edition 10.1.0 .0.4
- Oracle oracle10g_enterprise_edition 10.1.0.4
- Oracle oracle10g_enterprise_edition 10.1.0.4.2
- Oracle oracle10g_enterprise_edition 10.1.0 .5
- Oracle oracle10g_enterprise_edition 10.2
- Oracle oracle10g_enterprise_edition 10.2.0 .1
- Oracle oracle10g_enterprise_edition 10.2.0 .2
- Oracle oracle10g_enterprise_edition 10.2.0.2 64 bit
- Oracle oracle10g_enterprise_edition 10.2.0 .3
- Oracle oracle10g_enterprise_edition 10.2.0.4
- Oracle oracle10g_enterprise_edition 10.2.0 .5
- Oracle oracle10g_enterprise_edition 10.3.0 .1
- Oracle oracle10g_enterprise_edition 9.0.4 .0
- Oracle oracle10g_personal_edition 10.1.0 .0.2
- Oracle oracle10g_personal_edition 10.1.0 .0.3
- Oracle oracle10g_personal_edition 10.1.0 .0.3.1
- Oracle oracle10g_personal_edition 10.1.0 .0.4
- Oracle oracle10g_personal_edition 10.1.0.4
- Oracle oracle10g_personal_edition 10.1.0.5
- Oracle oracle10g_personal_edition 10.2
- Oracle oracle10g_personal_edition 10.2.0 .1
- Oracle oracle10g_personal_edition 10.2.0 .2
- Oracle oracle10g_personal_edition 10.2.0 .3
- Oracle oracle10g_personal_edition 10.2.0.4
- Oracle oracle10g_personal_edition 10.2.0 .5
- Oracle oracle10g_personal_edition 10.3.0 .1
- Oracle oracle10g_personal_edition 9.0.4 .0
- Oracle oracle10g_standard_edition 10.1.0 .0.2
- Oracle oracle10g_standard_edition 10.1.0 .0.3
- Oracle oracle10g_standard_edition 10.1.0 .0.3.1
- Oracle oracle10g_standard_edition 10.1.0 .0.4
- Oracle oracle10g_standard_edition 10.1.0 .0.5
- Oracle oracle10g_standard_edition 10.1.0.4
- Oracle oracle10g_standard_edition 10.1.0 .4.2
- Oracle oracle10g_standard_edition 10.1.0 .5
- Oracle oracle10g_standard_edition 10.2
- Oracle oracle10g_standard_edition 10.2.0.1
- Oracle oracle10g_standard_edition 10.2.0 .2
- Oracle oracle10g_standard_edition 10.2.0 .3
- Oracle oracle10g_standard_edition 10.2.0.4
- Oracle oracle10g_standard_edition 10.2.0 .5
- Oracle oracle10g_standard_edition 10.3.0 .1
- Oracle oracle11g_enterprise_edition 11.1.0 6
- Oracle oracle11g_enterprise_edition 11.1.0.7
- Oracle oracle11g_enterprise_edition 11.2.0.1.0
- Oracle oracle11g_standard_edition 11.1.0 6
- Oracle oracle11g_standard_edition 11.1.0.7
- Oracle oracle11g_standard_edition 11.2.0.1.0
References