CVE-2006-0259 Information

Description

Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors as identified by Oracle Vuln (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component. NOTE: details are unavailable from Oracle but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME GET_WORKERSTATUSLIST1010 GET_PARAMVALUES1010 GET_DUMPFILESET1010 GET_JOBSTATUS1010 ATTACH and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP.

Reference

http://secunia.com/advisories/18493 http://secunia.com/advisories/18608 http://securitytracker.com/id?1015499 http://www.kb.cert.org/vuls/id/545804 http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html http://www.osvdb.org/22544 http://www.securityfocus.com/bid/16287 http://www.vupen.com/english/advisories/2006/0243 http://www.vupen.com/english/advisories/2006/0323 https://exchange.xforce.ibmcloud.com/vulnerabilities/24321