CVE-2006-5340

2006-10-1801:07:00

[email protected]

web.nvd.nist.gov

oracle

spatial component

oracle database

vulnerabilities

remote attack

authenticated

mdsys.sdo_lrs

sql injection

input validation

sdo_drop_user

nvd

6.9 Medium

AI Score

Confidence

Low

7.1 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

0.866 High

EPSS

Percentile

98.6%

JSON

Multiple unspecified vulnerabilities in Oracle Spatial component in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) mdsys.sdo_lrs, aka Vuln# DB13, and (2) Vuln# DB17. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB13 is related to bypassing input validation for SQL injection related to convert_to_lrs_layer and dbms_assert, and DB17 is related to SQL injection in the trigger in the SDO_DROP_USER package.

Affected configurations

NVD

Node

oracledatabase_serverMatch8.1.7.4

oracledatabase_serverMatch9.0.1.5

oracledatabase_serverMatch9.2.0.7

oracledatabase_serverMatch10.1.0.5

oracledatabase_serverMatch10.2.0.2

CPENameOperatorVersion
oracle:database_serveroracle database servereq8.1.7.4
oracle:database_serveroracle database servereq9.0.1.5
oracle:database_serveroracle database servereq9.2.0.7
oracle:database_serveroracle database servereq10.1.0.5
oracle:database_serveroracle database servereq10.2.0.2

CPE	Name	Operator	Version
oracle:database_server	oracle database server	eq	8.1.7.4
oracle:database_server	oracle database server	eq	9.0.1.5
oracle:database_server	oracle database server	eq	9.2.0.7
oracle:database_server	oracle database server	eq	10.1.0.5
oracle:database_server	oracle database server	eq	10.2.0.2