CVE-2008-3984: Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote…

PriorityP343medium5.5CVSS 2.0

AVNACLAuSCPIPAN

EXPLOIT

EPSS

41.81%

98.5th percentile

Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3983.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
oracle	database_10g	—	—
oracle	database_10g	—	—
oracle	database_11i	—	—
oracle	database_9i	—	—
oracle	database_9i	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandexec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');↗

commandexec SYS.LT.REMOVEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');↗

commandEXEC extprocexec('net user hack 12345 /add');↗

pathC:\Oracle\product\10.1.0\db_1\bin\msvcrt.dll↗

→Monitor Oracle audit logs for calls to SYS.LT.REMOVEWORKSPACE or SYS.LT.CREATEWORKSPACE containing single-quote characters or SQL injection payloads (e.g., embedded AND clauses) in the workspace name argument. ↗
→Alert on any Oracle session where an unprivileged user is granted DBA role via EXECUTE IMMEDIATE inside an autonomous transaction function, which is the privilege-escalation mechanism used by this exploit. ↗
→Detect use of SYS.DBMS_FILE_TRANSFER.COPY_FILE to copy system DLLs (e.g., msvcrt.dll) into the Oracle BIN directory, a technique used to bypass extproc restrictions for OS command execution. ↗
→Flag creation of external PL/SQL libraries (CREATE OR REPLACE LIBRARY) pointing to DLLs in the Oracle BIN directory, as this is the extproc OS-command-execution stage of the exploit chain. ↗
→Any authenticated Oracle user with EXECUTE privilege on SYS.LT (or WMSYS.LT) is a potential attacker; audit EXECUTE grants on these packages. ↗

·The vulnerability exists in both SYS.LT and WMSYS.LT package synonyms; detection and patching must cover both entry points. ↗
·The extproc DLL-copy bypass technique is noted to work across Oracle 10g and 11g versions with updates applied, meaning patched instances may still be vulnerable to the OS-execution stage if extproc is enabled. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.