CVE-2005-4832
published 2005-12-31CVE-2005-4832: SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
41.67%
98.5th percentile
SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor Oracle DB audit logs for calls to SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION or SYS.DBMS_CDC_ISUBSCRIBE with a SUBSCRIPTION_NAME parameter containing SQL metacharacters (e.g., single-quote sequences like ''||...||''). ↗
- →Detect the 'cursor injection' technique: look for DBMS_SQL.OPEN_CURSOR / DBMS_SQL.PARSE being called immediately before SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION, with the cursor handle passed as the injected payload (e.g., dbms_sql.execute(<cursor>)). ↗
- →Alert on GRANT DBA or REVOKE DBA statements executed under SYS context by a non-SYS session, which is the privilege escalation goal of this exploit. ↗
- →Detect creation of a user-owned function named OWN with AUTHID CURRENT_USER and PRAGMA AUTONOMOUS_TRANSACTION, which is the helper function used in the v1 exploit to achieve privilege escalation. ↗
- ·The vulnerability requires an authenticated Oracle database session; it is not exploitable by unauthenticated/anonymous users. Scope detection rules to authenticated DB sessions only. ↗
- ·Affected versions are Oracle 9i up to 9.2.0.5 and 10g up to 10.1.0.4. Tune version-based detection or suppression accordingly. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (2)
exploitdb·2007-02-26
CVE-2005-4832 Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (2)
Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (2)
---
source: https://www.securityfocus.com/bid/13236/info
Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data. The 'SUBSCRIPTION_NAME' parameter is vulnerable.
Packages that employ this parameter execute with 'SYS' user privileges. Exploiting the SQL-injection vulnerability can allow an attacker to gain 'SYS' privileges.
The attacker can exploit this issue using malformed PL/SQL statements to pass unauthorized SQL statements to the database. A successful exploit could allow the attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
This issue was originally disclosed in the 'O
Exploit-DB
Oracle 9i/10g ACTIVATE_SUBSCRIPTION - SQL Injection (2)
exploitdb·2007-02-26
CVE-2005-4832 Oracle 9i/10g ACTIVATE_SUBSCRIPTION - SQL Injection (2)
Oracle 9i/10g ACTIVATE_SUBSCRIPTION - SQL Injection (2)
---
#!/usr/bin/perl
#
# Remote Oracle DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION exploit (9i/10g)
# - Version 2 - New "evil cursor injection" tip!
# - No "create procedure" privileg needed!
# - See: http://www.databasesecurity.com/ (Cursor Injection)
#
# Grant or revoke dba permission to unprivileged user
#
# Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0"
#
# REF: http://www.securityfocus.com/archive/1/396133
#
# AUTHOR: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# DATE: Copyright 2007 - Mon Feb 26 12:13:19 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
#
# bunker@fin:~$ perl dbms_cdc_subscribeV2.pl -h localhost -s test -u bunker -p **** -r
# [-] Wait...
# [-] Revo
Exploit-DB
Oracle 9i/10g - ACTIVATE_SUBSCRIPTION SQL Injection
exploitdb·2007-02-23
CVE-2005-4832 Oracle 9i/10g - ACTIVATE_SUBSCRIPTION SQL Injection
Oracle 9i/10g - ACTIVATE_SUBSCRIPTION SQL Injection
---
#!/usr/bin/perl
#
# Remote Oracle DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION exploit (9i/10g)
#
# Grant or revoke dba permission to unprivileged user
#
# Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0"
#
# REF: http://www.securityfocus.com/archive/1/396133
#
# AUTHOR: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# DATE: Copyright 2007 - Fri Feb 23 12:44:18 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
#
# bunker@fin:~$ perl dbms_cdc_subscribe.pl -h localhost -s test -u bunker -p **** -r
# [-] Wait...
# [-] Revoking DBA from BUNKER...
# DBD::Oracle::db do failed: ORA-01031: insufficient privileges (DBD ERROR: OCIStmtExecute) [for Statement "REVOKE DBA FROM BUNKER"] at
Exploit-DB
Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (1)
exploitdb·2007-02-23
CVE-2005-4832 Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (1)
Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (1)
---
source: https://www.securityfocus.com/bid/13236/info
Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data. The 'SUBSCRIPTION_NAME' parameter is vulnerable.
Packages that employ this parameter execute with 'SYS' user privileges. Exploiting the SQL-injection vulnerability can allow an attacker to gain 'SYS' privileges.
The attacker can exploit this issue using malformed PL/SQL statements to pass unauthorized SQL statements to the database. A successful exploit could allow the attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
This issue was originally disclosed in the 'O
Metasploit
Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION
metasploit
Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION
Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION
This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION package/function. This vulnerability affects to Oracle Database Server 9i up to 9.2.0.5 and 10g up to 10.1.0.4.
No writeups or analysis indexed.
http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlhttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txthttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlhttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdfhttp://www.securityfocus.com/archive/1/396133http://www.securityfocus.com/archive/1/404970http://www.securityfocus.com/bid/13236https://exchange.xforce.ibmcloud.com/vulnerabilities/20159http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlhttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txthttp://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlhttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdfhttp://www.securityfocus.com/archive/1/396133http://www.securityfocus.com/archive/1/404970http://www.securityfocus.com/bid/13236https://exchange.xforce.ibmcloud.com/vulnerabilities/20159
2005-12-31
Published