CVE

Id
9766  
CVE No.
CVE-2004-1338  
Status
Candidate  
Description
The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions.  
Phase
Assigned (20050106)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
66404 9766 CVE-2004-1338 BUGTRAQ:20041223 Oracle Trigger Abuse (#NISR2122004I)  View
66405 9766 CVE-2004-1338 URL:http://marc.info/?l=bugtraq&m=110382230614420&w=2  View
66406 9766 CVE-2004-1338 MISC:http://www.ngssoftware.com/advisories/oracle23122004I.txt  View
66407 9766 CVE-2004-1338 XF:oracle-triggers-gain-privileges(18655)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63010 JVNDB-2004-000352 Oracle Database のトリガにおける SQL インジェクションの脆弱性 ------------ CVE-2004-1339 9766 7.5 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000352.html  View