Vulnerability CVE-2006-5361 - CERT Civis.Net

Vulnerability Name:

CVE-2006-5361 (CCN-29782)

Assigned:

2006-10-17

Published:

2006-10-17

Updated:

2018-10-17

Summary:

Unspecified vulnerability in Oracle Containers for J2EE in Oracle Application Server 9.0.4.3, 10.1.2.0.0, and 10.1.2.0.1, and Oracle Collaboration Suite 9.0.4.2 and 10.1.2, has unknown impact and remote attack vectors, aka Vuln# OC4J03.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Informational

References:

Source: CCN
Type: Full-Disclosure Mailing List, Wed Oct 18 2006 - 01:55:35 CDT
Analysis of the Oracle October 2006 Critical Patch Update

Source: MITRE
Type: CNA
CVE-2006-5332

Source: MITRE
Type: CNA
CVE-2006-5333

Source: MITRE
Type: CNA
CVE-2006-5334

Source: MITRE
Type: CNA
CVE-2006-5335

Source: MITRE
Type: CNA
CVE-2006-5336

Source: MITRE
Type: CNA
CVE-2006-5337

Source: MITRE
Type: CNA
CVE-2006-5338

Source: MITRE
Type: CNA
CVE-2006-5339

Source: MITRE
Type: CNA
CVE-2006-5340

Source: MITRE
Type: CNA
CVE-2006-5341

Source: MITRE
Type: CNA
CVE-2006-5342

Source: MITRE
Type: CNA
CVE-2006-5343

Source: MITRE
Type: CNA
CVE-2006-5344

Source: MITRE
Type: CNA
CVE-2006-5345

Source: MITRE
Type: CNA
CVE-2006-5346

Source: MITRE
Type: CNA
CVE-2006-5347

Source: MITRE
Type: CNA
CVE-2006-5348

Source: MITRE
Type: CNA
CVE-2006-5349

Source: MITRE
Type: CNA
CVE-2006-5350

Source: MITRE
Type: CNA
CVE-2006-5351

Source: MITRE
Type: CNA
CVE-2006-5352

Source: MITRE
Type: CNA
CVE-2006-5353

Source: MITRE
Type: CNA
CVE-2006-5354

Source: MITRE
Type: CNA
CVE-2006-5355

Source: MITRE
Type: CNA
CVE-2006-5356

Source: MITRE
Type: CNA
CVE-2006-5357

Source: MITRE
Type: CNA
CVE-2006-5358

Source: MITRE
Type: CNA
CVE-2006-5359

Source: MITRE
Type: CNA
CVE-2006-5360

Source: MITRE
Type: CNA
CVE-2006-5361

Source: MITRE
Type: CNA
CVE-2006-5362

Source: MITRE
Type: CNA
CVE-2006-5363

Source: MITRE
Type: CNA
CVE-2006-5364

Source: MITRE
Type: CNA
CVE-2006-5365

Source: MITRE
Type: CNA
CVE-2006-5366

Source: MITRE
Type: CNA
CVE-2006-5367

Source: MITRE
Type: CNA
CVE-2006-5368

Source: MITRE
Type: CNA
CVE-2006-5369

Source: MITRE
Type: CNA
CVE-2006-5370

Source: MITRE
Type: CNA
CVE-2006-5371

Source: MITRE
Type: CNA
CVE-2006-5372

Source: MITRE
Type: CNA
CVE-2006-5373

Source: MITRE
Type: CNA
CVE-2006-5374

Source: MITRE
Type: CNA
CVE-2006-5375

Source: MITRE
Type: CNA
CVE-2006-5376

Source: MITRE
Type: CNA
CVE-2006-5377

Source: MITRE
Type: CNA
CVE-2006-5378

Source: CCN
Type: SA22396
Oracle Products Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
22396

Source: CCN
Type: SECTRACK ID: 1017077
Oracle Database and Other Products Have Multiple Unspecified Vulnerabilities With Unspecified Impact

Source: SECTRACK
Type: UNKNOWN
1017077

Source: CCN
Type: US-CERT VU#318764
Oracle DISABLE_HIERARCHY_INTERNAL procedure vulnerable to PL/SQL injection

Source: CCN
Type: US-CERT VU#446100
Oracle CREATE_CHANGE_TABLE procedure vulnerable to PL/SQL injection

Source: CCN
Type: US-CERT VU#716964
Oracle PREPARE_UNBOUNDED_VIEW procedure vulnerable to PL/SQL injection

Source: CCN
Type: US-CERT VU#717140
Oracle ENABLE_HIERARCHY_INTERNAL procedure vulnerable to PL/SQL injection

Source: CCN
Type: US-CERT VU#736324
Oracle SYS.DBMS_CDC_IMPDP package vulnerable to PL/SQL injection

Source: CCN
Type: US-CERT VU#869292
Oracle MDSYS.SDO_LRS package vulnerable to PL/SQL injection

Source: CCN
Type: Oracle Critical Patch Update - October 2006
Oracle Critical Patch Update Advisory - October 2006

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html

Source: CCN
Type: OSVDB ID: 31383
Oracle Pharmaceutical Applications Clinical Remote Data Capture Option Unspecified HTTP Issue

Source: CCN
Type: OSVDB ID: 31384
Oracle PeopleSoft PeopleTools Unspecified Authenticated HTTP Complete Compromise

Source: CCN
Type: OSVDB ID: 31385
Oracle PeopleSoft PeopleTools HTTP Remote Unauthenticated Unspecified Issue

Source: CCN
Type: OSVDB ID: 31386
Oracle PeopleSoft PeopleTools Unspecified Authenticated HTTP Remote Issue (PSE03)

Source: CCN
Type: OSVDB ID: 31387
Oracle PeopleSoft PeopleTools Unspecified Authenticated HTTP Remote Issue (PSE04)

Source: CCN
Type: OSVDB ID: 31388
Oracle PeopleSoft Enterprise Portal Unspecified Authenticated HTTP Remote Issue

Source: CCN
Type: OSVDB ID: 31389
Oracle PeopleSoft PeopleTools Authenticated HTTP Simple Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31390
Oracle PeopleSoft PeopleTools Authenticated HTTP Complex Remote Information Disclosure (PSE07)

Source: CCN
Type: OSVDB ID: 31391
Oracle PeopleSoft PeopleTools Authenticated HTTP Complex Remote Information Disclosure (PSE08)

Source: CCN
Type: OSVDB ID: 31392
Oracle JD Edwards EnterpriseOne HTML Server Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 31393
Oracle Multiple Products HTTP Server htdigest Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 31394
Oracle Multiple Products HTTP Server SSL Unspecified Integrity Issue

Source: CCN
Type: OSVDB ID: 31395
Oracle Multiple Products HTTP Server SSL Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 31396
Oracle Multiple Products HTTP Server Unspecified Remote Unauthenticated Issue

Source: CCN
Type: OSVDB ID: 31397
Oracle HTTP Server SSL Unspecified Remote DoS

Source: CCN
Type: OSVDB ID: 31398
Oracle Multiple Products HTTP Server SSL Unspecified Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31399
Oracle Multiple Products HTTP Server Mod_rewrite Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 31400
Oracle Multiple Products Single Sign-On (SSO) HTTP Uspecified Unauthenticated Remote Issue

Source: CCN
Type: OSVDB ID: 31401
Oracle Multiple Products Single Sign-On (SSO) HTTP Unauthenticated Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31402
Oracle Collaboration Suite Containers for J2EE HTTP Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31403
Oracle Multiple Products Containers for J2EE HTTP Remote DoS

Source: CCN
Type: OSVDB ID: 31404
Oracle Multiple Products Containers for J2EE Remote Method Invocation Remote DoS

Source: CCN
Type: OSVDB ID: 31405
Oracle Multiple Products Containers for J2EE Custom Login Module HTTP Information Disclosure

Source: CCN
Type: OSVDB ID: 31406
Oracle Collaboration Suite Process Mgmt & Notification ONS Remote DoS

Source: CCN
Type: OSVDB ID: 31407
Oracle Application Server HTTP Server PHP Module Remote DoS

Source: CCN
Type: OSVDB ID: 31408
Oracle Application Server Forms HTTP Unauthenticated Information Disclosure

Source: CCN
Type: OSVDB ID: 31409
Oracle Multiple Products Forms HTTP Unspecified Remote DoS

Source: CCN
Type: OSVDB ID: 31410
Oracle Application Server Forms HTTP Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31413
Oracle Application Server Containers for J2EE Web Services Security Information Disclosure

Source: CCN
Type: OSVDB ID: 31414
Oracle E-Business Suite Exchange HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 31415
Oracle E-Business Suite Application Object Library HTTP Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31416
Oracle E-Business Suite Applications Framework HTTP Unspecified Issue

Source: CCN
Type: OSVDB ID: 31417
Oracle E-Business Suite Applications Technology Stack HTTP Unspecified Remote DoS

Source: CCN
Type: OSVDB ID: 31418
Oracle E-Business Suite Balanced Scorecard Manager Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 31419
Oracle E-Business Suite Scripting Agent Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 31420
Oracle E-Business Suite Trading Community TCA Administrator Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 31421
Oracle E-Business Suite CRM Gateway for Mobile Devices Mobile Field Service Administrator Information Disclosure

Source: CCN
Type: OSVDB ID: 31422
Oracle E-Business Suite Email Center Administrator Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 31423
Oracle E-Business Suite iStore HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 31424
Oracle E-Business Suite Universal Work Queue iMeeting System Configure Responsibility Information Disclosure

Source: CCN
Type: OSVDB ID: 31425
Oracle E-Business Suite Application Object Library Unspecified Issue

Source: CCN
Type: OSVDB ID: 31426
Oracle E-Business Suite Install Base Administrator Unspecified Issue

Source: CCN
Type: OSVDB ID: 31428
Oracle Database Spatial SDO_DROP_USER_BEFORE Package SQL Injection

Source: CCN
Type: OSVDB ID: 31429
Oracle Database Spatial mdsys.md2 Unspecified Issue

Source: CCN
Type: OSVDB ID: 31452
Oracle Database Spatial mdsys.sdo_geom Unspecified Issue

Source: CCN
Type: OSVDB ID: 31459
Oracle Database Spatial mdsys.sdo_tune Unspecified Issue

Source: CCN
Type: OSVDB ID: 31460
Oracle Database Scheduler sys.dbms_scheduler Unspecified Issue

Source: CCN
Type: OSVDB ID: 31463
Oracle Database Spatial mdsys.sdo_geom Unspecified DoS

Source: CCN
Type: OSVDB ID: 31472
Oracle Application Express Unauthenticated Complex Unspecified Issue (APEX04)

Source: CCN
Type: OSVDB ID: 31488
Oracle Application Express Unauthenticated Unspecified Issue (APEX20)

Source: CCN
Type: OSVDB ID: 31489
Oracle Application Express Unauthenticated Unspecified Issue (APEX21)

Source: MISC
Type: UNKNOWN
http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html

Source: HP
Type: UNKNOWN
HPSBMA02133

Source: BID
Type: Patch
20588

Source: CCN
Type: BID-20588
Oracle October 2006 Security Update Multiple Vulnerabilities

Source: CERT
Type: US Government Resource
TA06-291A

Source: VUPEN
Type: UNKNOWN
ADV-2006-4065

Source: XF
Type: UNKNOWN
oracle-cpu-oct2006(29782)

Source: CCN
Type: IBM Internet Security Systems X-Force Database
Oracle Database PREPARE_UNBOUNDED_VIEW SQL injection

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:application_server:9.0.4.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:9.0.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:10.1.2.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.6:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.3:r1:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:9.0.4.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.1.5::fips:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.4:r1:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:9.0.4.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.0:r2:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.1:r2:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:10.1.2.0.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.1:r2:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.1.0.5:r1:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.2.0.7:r2:*:*:*:*:*:*

OR cpe:/a:oracle:collaboration_suite:10.1.2:r1:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_portal:8.8:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_portal:8.9:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:6i:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:9.0.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:10.2.0.2:r2:*:*:*:*:*:*

OR cpe:/a:oracle:application_server:9.0.4.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterpriseone:8.95:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterpriseone:8.96:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.22:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.47:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:9.0.4.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:10.1.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:developer_suite:10.1.2.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:apex:2.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*

OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*

OR cpe:/a:oracle:pharmaceutical:4.5.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:pharmaceutical:4.5.1:*:*:*:*:*:*:*

Denotes that component is vulnerable