Vulnerability CVE-2006-0256 - CERT Civis.Net

Vulnerability Name:

CVE-2006-0256 (CCN-18965)

Assigned:

2005-01-18

Published:

2005-01-18

Updated:

2012-10-23

Summary:

Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2006-0256

Source: MITRE
Type: CNA
CVE-2006-0257

Source: CCN
Type: SA18493
Oracle Products Multiple Vulnerabilities and Security Issues

Source: SECUNIA
Type: Vendor Advisory
18493

Source: CCN
Type: SA18608
HP Oracle for Openview Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
18608

Source: CCN
Type: SECTRACK ID: 1015499
Oracle Database and Other Products Have Multiple Unspecified Vulnerabilities With Unspecified Impact

Source: SECTRACK
Type: UNKNOWN
1015499

Source: CCN
Type: US-CERT VU#545804
Oracle products contain multiple vulnerabilities

Source: CERT-VN
Type: US Government Resource
VU#545804

Source: CCN
Type: Oracle Critical Patch Update Advisory January 2005
Critical Patch Update - January 2005

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html

Source: CCN
Type: OSVDB ID: 22539
Oracle Database Advanced Queuing sys.dbms_aqadm_sys* Unspecified SQL Issue

Source: CCN
Type: OSVDB ID: 22540
Oracle Database Change Data Capture DBMS_CDC_UTILITY Multiple Procedure SQL Injection

Source: CCN
Type: BID-12296
Oracle Database Multiple Unspecified Vulnerabilities

Source: BID
Type: UNKNOWN
16287

Source: CCN
Type: BID-16287
Oracle January Security Update Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-0243

Source: VUPEN
Type: UNKNOWN
ADV-2006-0323

Source: XF
Type: UNKNOWN
oracle-advancedqueuing-obtain-info(18965)

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.3:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:database_server:8.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.0.6.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.3:r1:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:9.0.4.2:r2:*:*:*:*:*:*

Denotes that component is vulnerable