CVE-2008-3979 Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE:....
MediumCVSS 5.5
EPSS 32.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle database 10g | = 10.1.0.5 | No fix listed |
| oracle database 10g | = 10.2.0.2 | No fix listed |
References
- 51354 vdb-entry
- 33525 third-party-advisory vendor-advisory
- www.oracle.com
- 20090113 Trigger Abuse of MDSYS.SDO_TOPO_DROP_FTBL in Oracle 10g R1 and R2 mailing-list
- 33177 vdb-entry
- 1021561 vdb-entry
- ADV-2009-0115 vdb-entry vendor-advisory
- 8074 exploit