Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
SQL Injection in package SDO_UTIL

Name SQL Injection in package SDO_UTIL [DB05]
Systems Affected 10g Rel. 1, 10g Rel. 2
Severity High Risk
Category SQL Injection
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE
Advisory 16 April 2008 (V 1.00)


Details
The package SDO_UTIL is vulnerable against SQL injection.


Patch Information
Apply the patches for Oracle CPU April 2008.


History
6-jun-2007 Oracle secalert was informed
15-apr-2008 Oracle published CPU April 2008 [DB05]
16-apr-2008 Advisory published


2008 by Red-Database-Security GmbH - last update 16-apr-2008