Oracle 8i/9i Database Server UTL_FILE Traversal Arbitrary File Manipulation

medium Nessus Plugin ID 17654

Language:

Synopsis

The remote database server is affected by directory traversal flaws.

Description

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple directory traversal vulnerabilities that may allow a remote attacker to read, write, or rename arbitrary files with the privileges of the Oracle Database server. An authenticated user can craft SQL queries such that they would be able to retrieve any file on the system and potentially retrieve and/or modify files in the same drive as the affected application.

Solution

Apply the January 2005 Critical Patch Update.

Plugin Details

Severity: Medium

ID: 17654

File Name: oracle_dir_traversal.nasl

Version: 1.19

Type: remote

Family: Databases

Published: 3/30/2005

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:oracle:database_server

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/7/2005

Vulnerability Publication Date: 3/8/2005

Reference Information

CVE: CVE-2005-0701

BID: 12749

Detections

Analytics