Vulnerability Name:

CVE-2006-1875 (CCN-26055)

Assigned:2006-04-18
Published:2006-04-18
Updated:2018-10-18
Summary:Unspecified vulnerability in Oracle Database Server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB11.
Note: Oracle has not disputed reliable researcher claims that this issue is SQL injection in MDSYS.SDO_LRS_TRIG_INS.
The most severe of these vulnerabilities could possibly expose affected computers to complete compromise.
CVSS v3 Severity:9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Data Manipulation
References:Source: CCN
Type: Full-Disclosure Mailing List, Tue Apr 18 2006 - 14:04:23 CDT
Multiple critical and high risk issues in Oracle's database server

Source: MITRE
Type: CNA
CVE-2006-1875

Source: CCN
Type: SA19712
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
19712

Source: CCN
Type: SA19859
HP Oracle for OpenView Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
19859

Source: CCN
Type: SECTRACK ID: 1015961
Oracle Database and Other Products Have Multiple Unspecified Vulnerabilities With Unspecified Impact

Source: SECTRACK
Type: Patch
1015961

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - April 2006

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html

Source: CCN
Type: Red-Database-Security Web site
Details Oracle Critical Patch Update April 2006 - V1.03

Source: MISC
Type: UNKNOWN
http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html

Source: HP
Type: UNKNOWN
SSRT061148

Source: BID
Type: Patch
17590

Source: CCN
Type: BID-17590
Oracle April 2006 Security Update Multiple Vulnerabilities

Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-109A
Oracle Products Contain Multiple Vulnerabilities

Source: VUPEN
Type: Vendor Advisory
ADV-2006-1397

Source: VUPEN
Type: Vendor Advisory
ADV-2006-1571

Source: XF
Type: UNKNOWN
oracle-sdolrstrigins-sql-injection(26055)

Source: XF
Type: UNKNOWN
oracle-sdolrstrigins-sql-injection(26055)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2006-1875 (CCN-39381)

    Assigned:2006-04-15
    Published:2006-04-15
    Updated:2018-10-18
    Summary:The most severe of these vulnerabilities could possibly expose affected computers to complete compromise.
    CVSS v3 Severity:9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
    Exploitability Metrics:Attack Vector (AV): Network
    Attack Complexity (AC): Low
    Privileges Required (PR): Low
    User Interaction (UI): Required
    Scope:Scope (S): Changed
    Impact Metrics:Confidentiality (C): High
    Integrity (I): High
    Availibility (A): High
    CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
    7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Authentication (Au): None
    Impact Metrics:Confidentiality (C): Complete
    Integrity (I): Complete
    Availibility (A): Complete
    9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
    6.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Athentication (Au): Single_Instance
    Impact Metrics:Confidentiality (C): Complete
    Integrity (I): Complete
    Availibility (A): Complete
    Vulnerability Type:CWE-noinfo
    Vulnerability Consequences:Gain Access
    References:Source: MITRE
    Type: CNA
    CVE-2006-0435

    Source: MITRE
    Type: CNA
    CVE-2006-1866

    Source: MITRE
    Type: CNA
    CVE-2006-1867

    Source: MITRE
    Type: CNA
    CVE-2006-1868

    Source: MITRE
    Type: CNA
    CVE-2006-1869

    Source: MITRE
    Type: CNA
    CVE-2006-1870

    Source: MITRE
    Type: CNA
    CVE-2006-1871

    Source: MITRE
    Type: CNA
    CVE-2006-1872

    Source: MITRE
    Type: CNA
    CVE-2006-1873

    Source: MITRE
    Type: CNA
    CVE-2006-1874

    Source: MITRE
    Type: CNA
    CVE-2006-1875

    Source: MITRE
    Type: CNA
    CVE-2006-1876

    Source: MITRE
    Type: CNA
    CVE-2006-1877

    Source: MITRE
    Type: CNA
    CVE-2006-1879

    Source: MITRE
    Type: CNA
    CVE-2006-1880

    Source: MITRE
    Type: CNA
    CVE-2006-1881

    Source: MITRE
    Type: CNA
    CVE-2006-1882

    Source: MITRE
    Type: CNA
    CVE-2006-1883

    Source: MITRE
    Type: CNA
    CVE-2006-1884

    Source: MITRE
    Type: CNA
    CVE-2006-1885

    Source: MITRE
    Type: CNA
    CVE-2006-1886

    Source: MITRE
    Type: CNA
    CVE-2006-1887

    Source: CCN
    Type: Oracle Critical Patch Update - April 2006
    Critical Patch Update - April 2006

    Source: CCN
    Type: IBM Internet Security Systems X-Force Database
    Oracle PL/SQL Gateway SQL command execution

    Source: XF
    Type: UNKNOWN
    oracle-cpu-apr2006(39381)

    Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:9.0.4.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.0:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.1:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.1:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.1:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.2:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95.f1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95.j1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.46.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.46:ga:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.47.04:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.47:ga:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle database server 9.0.1.5
    oracle database server 9.2.0.7
    oracle database server 10.1.0.5
    oracle database server 9.2.0.6 r2
    oracle database server 10.1.0.4 r1
    oracle database server 10.1.0.5 r1
    oracle database server 9.2.0.7 r2
    oracle database server 8.1.7.4
    oracle database server 9.2.0.6 r2
    oracle application server 9.0.4.1
    oracle collaboration suite 9.0.4.2 r2
    oracle database server 10.1.0.4 r1
    oracle e-business suite 11.0
    oracle enterprise manager grid control 10.1.0.3
    oracle application server 9.0.4.2
    oracle enterprise manager grid control 10.1.0.4
    oracle application server 10.1.2.0.0 r2
    oracle application server 10.1.2.0.1 r2
    oracle application server 10.1.2.0.2 r2
    oracle database server 10.2.0.1 r2
    oracle database server 10.1.0.5 r1
    oracle database server 9.2.0.7 r2
    oracle collaboration suite 10.1.1 r1
    oracle collaboration suite 10.1.2 r1
    oracle e-business suite 11.5.10
    oracle database server 10.2.0.2 r2
    oracle enterprise manager grid control 10.2.0.1
    oracle enterpriseone 8.95
    oracle e-business suite 11.5.1
    oracle e-business suite 11.5.2
    oracle e-business suite 11.5.3
    oracle e-business suite 11.5.4
    oracle e-business suite 11.5.5
    oracle e-business suite 11.5.6
    oracle e-business suite 11.5.7
    oracle e-business suite 11.5.8
    oracle e-business suite 11.5.9
    oracle enterpriseone 8.95.f1
    oracle enterpriseone 8.95.j1
    oracle peoplesoft enterprise tools 8.46.12
    oracle peoplesoft enterprise tools 8.46 ga
    oracle peoplesoft enterprise tools 8.47.04
    oracle peoplesoft enterprise tools 8.47 ga
    oracle pharmaceutical 4.5.0
    oracle pharmaceutical 4.5.1
    oracle pharmaceutical 4.5.2