Bird_banner_small4
Oracle Database DBMS_JAVA.SET_OUTPUT_TO_JAVA Privilege Escalation
FSCID FSC20100208-02
CVEID(s)
Severity Critical
Description

A vulnerability exists in Oracle Database 11g server that could allow users with limited privileges to execute SQL commands with SYS privileges on the server. The vulnerability is due to an access control weakness that allows non-privileged users to execute methods in the DBMS_JAVA package. Remote authenticated users with only CREATE_SESSION privileges can exploit this vulnerability via the SET_OUTPUT_TO_JAVA method and execute arbitrary SQL commands on the target server.
Affected Products
  • Oracle Database Server (11g)
CVSS Score Base:
  • Access vector is NETWORK
  • Access complexity is MEDIUM
  • Level of authentication required is SINGLE
  • Impact of this vulnerability on data confidentiality is PARTIAL
  • Impact of this vulnerability on data integrity is PARTIAL
  • Impact of this vulnerability on data availability is PARTIAL
Temporal:
  • The exploitability level of this vulnerability is PROOF OF CONCEPT
  • The remediation level of this vulnerability is WORKAROUND
  • The report confidence level of this vulnerability is CONFIRMED