CVE-2009-0991

CVE-2009-0991 is a vulnerability in the Oracle Database TNS Listener (Listener component) that allows remote attackers to cause a denial of service by sending crafted TNS packets. The vulnerability affects Oracle Database versions including 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7, an...

CVE-2009-0979

CVE-2009-0979 maps to a buffer overflow in Oracle Database 9i/9.2 Resource Manager, specifically in the plan name parameter used by ALTER SYSTEM SET RESOURCE_MANAGER_PLAN and SYS.DBMS_RESOURCE_MANAGER.SWITCH_PLAN. The vulnerability allows a remote attacker with database authentication (needs ALTE...

CVE-2009-0997

CVE-2009-0997 affects Oracle Database 11.1.0.6 (Database Vault) via an unspecified vulnerability related to DBMS_SYS_SQL that could allow remote authenticated users to affect confidentiality. The issue is addressed in Oracle’s April 2009 Critical Patch Update; apply CPU APR 2009 to mitigate.

CVE-2009-0985

CVE-2009-0985 maps to an unspecified vulnerability in the Core RDBMS component of Oracle Database versions 10.1.0.5, 10.2.0.4 and 11.1.0.6. The NVD entry notes that remote authenticated users with the IMP_FULL_DATABASE role can affect confidentiality, integrity and availability. Connected documen...

CVE-2009-0975

Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0978...

Oracle Database Client Detection

Binary data 4994.prm...

KLA10282 Multiple vulnerabilities in Oracle Database

Unspecified vulnerabilities were found in the Oracle Database. By exploiting these vulnerabilities malicious users can affect availability, confidentiality and integrity. These vulnerabilities can be exploited remotely via unknown vectors. Original advisories - Related products Oracle-Database CV...

Oracle Database Server Detection

Binary data 4995.prm...

Oracle Database Version Detection

Binary data 4993.prm...

SQL injection

Added: 04/10/2009 Background Structured Query Language SQL is the most common language understood by modern relational databases. Problem A web program uses input parameters within an SQL query in an unsafe manner. This could allow a remote attacker to inject arbitrary SQL commands via a speciall...

Oracle SMB Relay Code Execution

This module will help you to get Administrator access to OS using an unprivileged Oracle database user you need only CONNECT and RESOURCE privileges. To do this you must firstly run smbsniffer or smbrelay module on your sever. Then you must connect to Oracle database and run this module...

Oracle Secure Backup NDMP Packet Handling Multiple Denial of Service (CVE-2008-5441)

Oracle Database Server is an enterprise-level relational database application suite. Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. Oracle Secure Backup is using NDMP protocol to...

RedHat Update for kernel RHSA-2008:0154-01

Check for the Version of kernel OpenVAS Vulnerability Test RedHat Update for kernel RHSA-2008:0154-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Oracle shops don't mandate use of security patches

A lack of corporate mandates to quickly install Oracle Corp.’s security patches may be leaving many Oracle database installations exposed to vulnerabilities for extended periods of time, according to survey results released last week. From the article: In a pair of online surveys jointly conducte...

Oracle Secure Backup NDMP CONNECT_CLIENT_AUTH Command Buffer Overflow (CVE-2008-5444)

Oracle Database Server is an enterprise-level relational database application suite. Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. Oracle Secure Backup is using NDMP protocol to...

Oracle Database SYS.OLAPIMPL_T Package ODCITABLESTART Buffer Overflow (CVE-2008-3974)

Oracle Database Server is an enterprise-level relational database application suite. A buffer overflow vulnerability has been reported in the Oracle Database Server SYS.OLAPIMPLT package. The vulnerability is due to an error in the Oracle Database Server that fails to properly validate user...

Oracle Database OLAP component ODCITABLESTART buffer overflow

Added: 02/06/2009 CVE: CVE-2008-3974 BID: 33177 OSVDB: 51347 Background The Online Analytical Processing OLAP component of Oracle Database is a set of stored procedures used for multi-dimensional analytical queries. Problem A buffer overflow vulnerability in the ODCITABLESTART function allows...

Oracle Database OLAP component ODCITABLESTART buffer overflow

Added: 02/06/2009 CVE: CVE-2008-3974 BID: 33177 OSVDB: 51347 Background The Online Analytical Processing OLAP component of Oracle Database is a set of stored procedures used for multi-dimensional analytical queries. Problem A buffer overflow vulnerability in the ODCITABLESTART function allows...

Oracle Database OLAP component ODCITABLESTART buffer overflow

Added: 02/06/2009 CVE: CVE-2008-3974 BID: 33177 OSVDB: 51347 Background The Online Analytical Processing OLAP component of Oracle Database is a set of stored procedures used for multi-dimensional analytical queries. Problem A buffer overflow vulnerability in the ODCITABLESTART function allows...

CVE-2008-6065

Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the...