2006-3698 | Oracle Database Server sql injection (BID-19054 / XFDB-27897)

By Max On Jul 12, 2021

CVSS Meta Temp Score	Current Exploit Price (≈)	CTI Interest Score
9.3	$5k-$25k	1.18

A vulnerability classified as very critical has been found in Oracle Database Server 10.1.0.5 (Database Software). This affects some unknown processing. The manipulation of the argument sys.kupw$worker with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. This is going to have an impact on confidentiality, integrity, and availability. An attacker might be able inject and/or alter existing SQL statements which would influence the database exchange. The summary by CVE is:

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.

The weakness was released 07/21/2006 by Esteban Martinez Fayo (Alex) with Next Generation Security Software (Website). The advisory is shared at us-cert.gov. This vulnerability is uniquely identified as CVE-2006-3698 since 07/18/2006. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/12/2021).

It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 56053 (Oracle Database Multiple Vulnerabilities (July 2006 CPU)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Databases.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 4558.

The vulnerability is also documented in the databases at SecurityFocus (BID 19054), X-Force (27897), Secunia (SA21111), SecurityTracker (ID 1016529) and Vulnerability Center (SBV-12311). Entries connected to this vulnerability are available at 31427, 31426, 31425 and 31424.

Type

Vendor

Name

VulDB Meta Base Score: 9.8
VulDB Meta Temp Score: 9.3

VulDB Base Score: 9.8
VulDB Temp Score: 9.3
VulDB Vector: 🔍
VulDB Reliability: 🔍

AV	AC	Au	C	I	A
🔍	🔍	🔍	🔍	🔍	🔍
🔍	🔍	🔍	🔍	🔍	🔍
🔍	🔍	🔍	🔍	🔍	🔍

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
unlock	unlock	unlock	unlock	unlock	unlock
unlock	unlock	unlock	unlock	unlock	unlock
unlock	unlock	unlock	unlock	unlock	unlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Class: Sql injection
CWE: CWE-89
ATT&CK: Unknown

Local: No
Remote: Yes

Availability: 🔍
Access: Public
Status: Proof-of-Concept

Price Prediction: 🔍
Current Price Estimation: 🔍

0-Day	unlock	unlock	unlock	unlock
Today	unlock	unlock	unlock	unlock

Nessus ID: 56053
Nessus Name: Oracle Database Multiple Vulnerabilities (July 2006 CPU)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍

Threat Intelligenceinfoedit

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍Recommended: no mitigation known
Status: 🔍

0-Day Time: 🔍
TippingPoint: 🔍

McAfee IPS: 🔍
McAfee IPS Version: 🔍

SourceFire IPS: 🔍
ISS Proventia IPS: 🔍
PaloAlto IPS: 🔍
Fortigate IPS: 🔍

07/18/2006 🔍
07/18/2006 +0 days 🔍
07/18/2006 +0 days 🔍
07/18/2006 +0 days 🔍
07/19/2006 +1 days 🔍
07/20/2006 +1 days 🔍
07/21/2006 +1 days 🔍
07/21/2006 +0 days 🔍
11/16/2011 +1944 days 🔍
03/12/2015 +1212 days 🔍
04/18/2016 +403 days 🔍
07/12/2021 +1911 days 🔍Vendor: https://www.oracle.com