CVE-2005-4832

Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2005-12-31 CVE Published
2007-02-23 First Exploit
2007-03-03 CVE Reserved
2024-08-08 CVE Updated
2024-11-06 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (12)

URL	Tag	Source
http://www.securityfocus.com/bid/13236	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/20159	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/25452	2007-02-23
https://www.exploit-db.com/exploits/25453	2007-02-26
https://www.exploit-db.com/exploits/3378	2007-02-26
https://www.exploit-db.com/exploits/3364	2007-02-23
http://www.appsecinc.com/resources/alerts/oracle/2005-02.html	2024-08-08
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt	2024-08-08
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql	2024-08-08
http://www.securityfocus.com/archive/1/396133	2024-08-08
http://www.securityfocus.com/archive/1/404970	2024-08-08

URL	Date	SRC
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf	2017-07-29

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_9.0.4.0 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_9.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_9.0.4_.0 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_9.0.4_.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_10.1.0.2 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_10.1.0.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_10.1.0.3 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_10.1.0.3"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_10.1.0.3.1 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_10.1.0.3.1"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_10.1.0.4 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_10.1.0.4"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				enterprise_10.2.3 Search vendor "Oracle" for product "Oracle10g" and version "enterprise_10.2.3"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_9.0.4.0 Search vendor "Oracle" for product "Oracle10g" and version "personal_9.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_9.0.4_.0 Search vendor "Oracle" for product "Oracle10g" and version "personal_9.0.4_.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.1.0.2 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.1.0.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.1.0.3 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.1.0.3"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.1.0.3.1 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.1.0.3.1"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.1.0.4 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.1.0.4"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.1_.0.2 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.1_.0.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.2.3 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.2.3"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				personal_10.10.3.1 Search vendor "Oracle" for product "Oracle10g" and version "personal_10.10.3.1"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_9.0.4.0 Search vendor "Oracle" for product "Oracle10g" and version "standard_9.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_9.0.4_.0 Search vendor "Oracle" for product "Oracle10g" and version "standard_9.0.4_.0"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.2 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.3 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.3"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.3.1 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.3.1"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.4 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.4"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.4.2 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.4.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1.0.5 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1.0.5"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.1_.0.2 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.1_.0.2"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.2.0.1 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Oracle10g Search vendor "Oracle" for product "Oracle10g"				standard_10.2.3 Search vendor "Oracle" for product "Oracle10g" and version "standard_10.2.3"		-		Affected