Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
SQL Injection in package SDO_GEOM

Name SQL Injection in package SDO_GEOM [DB06]
Systems Affected 9iRel. 1 - 10g Rel. 2
Severity High Risk
Category SQL Injection
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE
Advisory 16 April 2008 (V 1.00)


Details
The package SDO_GEOM (part of Oracle Spatial) is vulnerable against SQL injection.


Patch Information
Apply the patches for Oracle CPU April 2008.


History
6-jun-2007 Oracle secalert was informed
15-apr-2008 Oracle published CPU April 2008 [DB06]
16-apr-2008 Advisory published


2008 by Red-Database-Security GmbH - last update 16-apr-2008