Vulnerability CVE-2005-1495 - CERT Civis.Net

Vulnerability Name:

CVE-2005-1495 (CCN-20407)

Assigned:

2005-05-02

Published:

2005-05-02

Updated:

2017-07-11

Summary:

Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.
Applying patchset 10.1.0.4 is fixing this issue for Oracle 10g. Oracle 9i is still vulnerable.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Data Manipulation

References:

Source: CCN
Type: Full-Disclosure Mailing List, Thu May 05 2005 - 06:06:20 CDT
Oracle 9i / 10g Fine Grained Auditing Issue

Source: MITRE
Type: CNA
CVE-2005-1495

Source: BUGTRAQ
Type: UNKNOWN
20050505 Oracle 9i / 10g Fine Grained Auditing Issue

Source: CCN
Type: Oracle Database Documentation Library
Oracle Database ONline Documentation 10g Release 1 (10.1)

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#777773

Source: CCN
Type: Oracle Database Web page
Oracle Database

Source: CCN
Type: Oracle Database Server Patch Sets Web page
Oracle Database Server Patch Sets

Source: CCN
Type: OSVDB ID: 16258
Oracle Database Fine Grained Auditing (FGA) SELECT Statement Logging Weakness

Source: CCN
Type: Red Database Security VU#3777773
Oracle Fine Grained Auditing Issue

Source: MISC
Type: Exploit, Vendor Advisory
http://www.red-database-security.com/advisory/oracle-fine-grained-auditing-issue.html

Source: CCN
Type: BID-13510
Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

Source: BID
Type: UNKNOWN
16258

Source: CCN
Type: BID-16258
AmbiCom Blue Neighbors Bluetooth Stack Object Push Buffer Overflow Vulnerability

Source: XF
Type: UNKNOWN
oracle-audit-data-manipulation(20407)

Source: XF
Type: UNKNOWN
oracle-audit-data-manipulation(20407)

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:application_server:10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.0.3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:9.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:release_2_9.2.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:release_2_9.2.2:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:database_server:9.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.2:*:*:*:*:*:*:*

Denotes that component is vulnerable