Oracle Database Server contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'SUBSCRIPTION_NAME' parameter in the 'DBMS_CDC_SUBSCRIBE' package not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Oracle has released a patch which attempted to patch this vulnerability. Subsequent testing has revealed that the actual source of the problem lies
within the underlying java class files. The April patch fails to properly load
the newer patched classes which means that these problems can still be
exploited on some versions. Oracle 10g systems with patchset 2 and the April patch have been tested and appear to mitigate the issue.
appsecinc.com -
Application Security, Inc.
