Vulnerability Name:

CVE-2006-1885 (CCN-26056)

Assigned:2006-04-18
Published:2006-04-18
Updated:2018-10-18
Summary:Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Full-Disclosure Mailing List, Tue Apr 18 2006 - 14:04:23 CDT
Multiple critical and high risk issues in Oracle's database server

Source: MITRE
Type: CNA
CVE-2006-1885

Source: CCN
Type: SA19712
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
19712

Source: CCN
Type: SA19859
HP Oracle for OpenView Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
19859

Source: CCN
Type: SECTRACK ID: 1015961
Oracle Database and Other Products Have Multiple Unspecified Vulnerabilities With Unspecified Impact

Source: SECTRACK
Type: Patch
1015961

Source: CCN
Type: US-CERT VU#443265
Oracle Reporting Framework vulnerability

Source: CERT-VN
Type: US Government Resource
VU#443265

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - April 2006

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html

Source: CCN
Type: Red-Database-Security Web site
Details Oracle Critical Patch Update April 2006 - V1.03

Source: HP
Type: UNKNOWN
SSRT061148

Source: BID
Type: Patch
17590

Source: CCN
Type: BID-17590
Oracle April 2006 Security Update Multiple Vulnerabilities

Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-109A
Oracle Products Contain Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-1397

Source: VUPEN
Type: UNKNOWN
ADV-2006-1571

Source: XF
Type: UNKNOWN
oracle-reporting-framework-access(26056)

Source: XF
Type: UNKNOWN
oracle-reporting-framework-access(26056)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:enterprise_manager:9.0.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager:9.2.0.7:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:enterprise_manager:9.0.1.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2006-1885 (CCN-39381)

    Assigned:2006-04-15
    Published:2006-04-15
    Updated:2018-10-18
    Summary:Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.
    CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
    Exploitability Metrics:Attack Vector (AV): Network
    Attack Complexity (AC): Low
    Privileges Required (PR): None
    User Interaction (UI): None
    Scope:Scope (S): Changed
    Impact Metrics:Confidentiality (C): High
    Integrity (I): High
    Availibility (A): High
    CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
    7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Authentication (Au): None
    Impact Metrics:Confidentiality (C): Complete
    Integrity (I): Complete
    Availibility (A): Complete
    10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
    7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Athentication (Au): None
    Impact Metrics:Confidentiality (C): Complete
    Integrity (I): Complete
    Availibility (A): Complete
    Vulnerability Type:CWE-Other
    Vulnerability Consequences:Gain Access
    References:Source: MITRE
    Type: CNA
    CVE-2006-0435

    Source: MITRE
    Type: CNA
    CVE-2006-1866

    Source: MITRE
    Type: CNA
    CVE-2006-1867

    Source: MITRE
    Type: CNA
    CVE-2006-1868

    Source: MITRE
    Type: CNA
    CVE-2006-1869

    Source: MITRE
    Type: CNA
    CVE-2006-1870

    Source: MITRE
    Type: CNA
    CVE-2006-1871

    Source: MITRE
    Type: CNA
    CVE-2006-1872

    Source: MITRE
    Type: CNA
    CVE-2006-1873

    Source: MITRE
    Type: CNA
    CVE-2006-1874

    Source: MITRE
    Type: CNA
    CVE-2006-1875

    Source: MITRE
    Type: CNA
    CVE-2006-1876

    Source: MITRE
    Type: CNA
    CVE-2006-1877

    Source: MITRE
    Type: CNA
    CVE-2006-1879

    Source: MITRE
    Type: CNA
    CVE-2006-1880

    Source: MITRE
    Type: CNA
    CVE-2006-1881

    Source: MITRE
    Type: CNA
    CVE-2006-1882

    Source: MITRE
    Type: CNA
    CVE-2006-1883

    Source: MITRE
    Type: CNA
    CVE-2006-1884

    Source: MITRE
    Type: CNA
    CVE-2006-1885

    Source: MITRE
    Type: CNA
    CVE-2006-1886

    Source: MITRE
    Type: CNA
    CVE-2006-1887

    Source: CCN
    Type: Oracle Critical Patch Update - April 2006
    Critical Patch Update - April 2006

    Source: CCN
    Type: IBM Internet Security Systems X-Force Database
    Oracle PL/SQL Gateway SQL command execution

    Source: XF
    Type: UNKNOWN
    oracle-cpu-apr2006(39381)

    Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:9.0.4.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:9.0.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.0:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.1:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:application_server:10.1.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.1:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.1:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:collaboration_suite:10.1.2:r1:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_grid_control:10.2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95.f1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterpriseone:8.95.j1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.46.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.46:ga:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.47.04:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_tools:8.47:ga:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:pharmaceutical:4.5.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle enterprise manager 9.0.1.5
    oracle enterprise manager 9.2.0.7
    oracle enterprise manager 9.0.1.5
    oracle database server 8.1.7.4
    oracle database server 9.2.0.6 r2
    oracle application server 9.0.4.1
    oracle collaboration suite 9.0.4.2 r2
    oracle database server 10.1.0.4 r1
    oracle e-business suite 11.0
    oracle enterprise manager grid control 10.1.0.3
    oracle application server 9.0.4.2
    oracle enterprise manager grid control 10.1.0.4
    oracle application server 10.1.2.0.0 r2
    oracle application server 10.1.2.0.1 r2
    oracle application server 10.1.2.0.2 r2
    oracle database server 10.2.0.1 r2
    oracle database server 10.1.0.5 r1
    oracle database server 9.2.0.7 r2
    oracle collaboration suite 10.1.1 r1
    oracle collaboration suite 10.1.2 r1
    oracle e-business suite 11.5.10
    oracle database server 10.2.0.2 r2
    oracle enterprise manager grid control 10.2.0.1
    oracle enterpriseone 8.95
    oracle e-business suite 11.5.1
    oracle e-business suite 11.5.2
    oracle e-business suite 11.5.3
    oracle e-business suite 11.5.4
    oracle e-business suite 11.5.5
    oracle e-business suite 11.5.6
    oracle e-business suite 11.5.7
    oracle e-business suite 11.5.8
    oracle e-business suite 11.5.9
    oracle enterpriseone 8.95.f1
    oracle enterpriseone 8.95.j1
    oracle peoplesoft enterprise tools 8.46.12
    oracle peoplesoft enterprise tools 8.46 ga
    oracle peoplesoft enterprise tools 8.47.04
    oracle peoplesoft enterprise tools 8.47 ga
    oracle pharmaceutical 4.5.0
    oracle pharmaceutical 4.5.1
    oracle pharmaceutical 4.5.2