CVE:CVE-2006-0552
CNNVD:CNNVD-200602-062
Oracle Database是一款大型商业数据库系统。
Oracle Database的登录过程实现存在漏洞，远程攻击者可能在登录过程中对服务器进行SQL注入攻击。在登录过程中，协议认证部分由两个步骤组成，包含有两个不同的客户端请求和两个服务器响应。第一个请求(消息代码0x76)仅包含有用户名，而第二个请求(消息代码0x73)包含有用户名和乱码的口令。第二个请求还包含有"名称－值"对列表，描述客户端的各种属性，其中AUTH_ALTER_SESSION值用于创建区域和语言相关的会话属性。这个值中可能包含有任意SQL语句。此外，该命令是以Oracle访问控制机制之外的SYS用户环境执行的，因此通过将AUTH_ALTER_SESSION值设置为任意SQL语句攻击者就可以在数据库中执行任意命令。具体来说，攻击者可以创建新的数据库帐号并为帐号创建DBA权限。
solution:Upgrade oracle 10g_enterprise_manager_grid_control to a higher version than 10.1_.0.3,10.1_.0.4,and avoid the version 10.1_.0.3,10.1_.0.4; Upgrade oracle application_server to a higher version than 1.0.2.2,1.0.2.2:r1,9.0.4,9.0.4.1,9.0.4.2,10.1.2,10.1.2.0.0:r2,10.1.2.0.1,10.1.2.0.1:r2,10.1.2.0.2,10.1.2.0.2:r2,10.1.2.1.0,and avoid the version 1.0.2.2,1.0.2.2:r1,9.0.4,9.0.4.1,9.0.4.2,10.1.2,10.1.2.0.0:r2,10.1.2.0.1,10.1.2.0.1:r2,10.1.2.0.2,10.1.2.0.2:r2,10.1.2.1.0; Upgrade oracle collaboration_suite to a higher version than 9.0.4.2:r2,10.1.1:r1,10.1.2:r1,release_1,and avoid the version 9.0.4.2:r2,10.1.1:r1,10.1.2:r1,release_1; Upgrade oracle database_server to a higher version than 8.0.6,8.0.6.3,8.1.7.4,and avoid the version 8.0.6,8.0.6.3,8.1.7.4; Upgrade oracle developer_suite to a higher version than 9.0.2.1,9.0.4.1,9.0.4.2,10.1.2,and avoid the version 9.0.2.1,9.0.4.1,9.0.4.2,10.1.2; Upgrade oracle e-business_suite to a higher version than 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9,11.5.10,and avoid the version 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9,11.5.10; Upgrade oracle enterpriseone to a higher version than 8.95.f1,sp23_l1,and avoid the version 8.95.f1,sp23_l1; Upgrade oracle oracle10g to a higher version than enterprise_10.1.0.3,enterprise_10.1.0.4,personal_10.1.0.3,personal_10.1.0.4,standard_10.1.0.3,standard_10.1.0.4,standard_10.1.0.4.2,standard_10.1.0.5,standard_10.2.0.1,and avoid the version enterprise_10.1.0.3,enterprise_10.1.0.4,personal_10.1.0.3,personal_10.1.0.4,standard_10.1.0.3,standard_10.1.0.4,standard_10.1.0.4.2,standard_10.1.0.5,standard_10.2.0.1; Upgrade oracle oracle8i to a higher version than enterprise_8.1.7.4,standard_8.0.6,standard_8.0.6.3,standard_8.1.7.4,and avoid the version enterprise_8.1.7.4,standard_8.0.6,standard_8.0.6.3,standard_8.1.7.4; Upgrade oracle oracle9i to a higher version than enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.0.1.5_fips,standard_9.2.0.6,standard_9.2.0.7,and avoid the version enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.0.1.5_fips,standard_9.2.0.6,standard_9.2.0.7; Upgrade oracle peoplesoft_enterprise_portal to a higher version than 8.4,8.8,8.9,and avoid the version 8.4,8.8,8.9; Upgrade oracle workflow to a higher version than 11.5.1,11.5.9.5,and avoid the version 11.5.1,11.5.9.5