OSVDB ID: 86386

Title: Oracle Database Core RDBMS Component Alter FBA Table Name SQL Injection

Info

Disclosure
Oct 16, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Oct 16, 2012

Description

 Oracle Database contains a flaw in the Core RDBMS component that may allow an attacker to carry out an SQL injection attack. The issue is due to the program not properly sanitizing user-supplied input to the Alter FBA Table. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Classification

 Location: Remote / Network Access
Attack Type: Attack Type Unknown
Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability
Solution: Patch / RCS
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure
OSVDB: Authentication Required

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability. Check the vendor advisory in the references section.

Products

Oracle Corporation

Oracle Database

 11.1.0.7
11.2.0.2
11.2.0.3

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/86386