Oracle Database Server contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the DBMS_DATAPUMP package not properly sanitizing user-supplied input to the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT procedures. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch (Jan2006 Critical Patch Update) to address this vulnerability.

• Bugtraq ID: 16287
• Secunia Advisory ID: 18493 18608
• CVE ID: 2006-0259 (see also: NVD) 2006-0264 (see also: NVD) 2006-0551 (see also: NVD)
• CERT VU: 545804
• VUPEN Advisory: ADV-2006-0243 ADV-2006-0323
• Keyword: DB06 Document ID: c00593668 HPSBMA02094 SSRT061104
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0420.html
• News Article: http://news.com.com/Oracle+fixes+pile+of+bugs/2100-1002_3-6027847.html
• Vendor Specific Advisory URL: http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html
  http://www4.itrc.hp.com/service/cki/docDisplay.do?docId=c00593668
• Other Advisory URL: http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html

Unknown or Incomplete