OSVDB ID: 39930

Title: Oracle Database Upgrade/Downgrade SYS.DBMS_UPGRADE_INTERNAL Multiple Unspecified SQL Injections

Info

Disclosure

Apr 18, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Products

Unknown or Incomplete

References

CVE ID: 2007-2113 (see also: NVD)
Secunia Advisory ID: 24929 24969 26669
Related OSVDB ID: 39920 39921 39922 39923 39924 39925 39926 39927 39928 39929 39931 39932 39933 39934 39935 39936 39937 39938 39939 39940 39941 39942 39943 39944 39945 39946 39947 39948 39949 39950 39951 39952 39953 39954 39955 39958 39959
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-04/0302.html
Other Advisory URL: http://itrc.hp.com/service/cki/docDisplay.do?docId=c00727143
http://www-1.ibm.com/support/docview.wss?uid=swg21268889
http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade_internal.html
News Article: http://news.com.com/Oracle+patches+to+fix+37+flaws/2100-1002_3-6175041.html
Vendor Specific Advisory URL: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/39930