Update Protection against Oracle Database REPCAT_RPC.VALIDATE_REMOTE_RC SQL Injection
| Check Point Reference: | CPAI-2009-195 | |
| Date Published: | ||
| Severity: | ||
| Source: | Secunia Advisory: SA35776 | |
| Industry Reference(s): | ||
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Oracle Database 10.1.0.5 and prior Oracle Database 10g Release 2 10.2.0.3 and prior Oracle Database 9i Release 2 9.2.0.8 and prior Oracle Database 9i Release 2 9.2.0.8DV and prior | ||
| Vulnerability Description An SQL injection vulnerability has been reported in Oracle Database server, an enterprise-level relational database application suite. Remote authenticated attackers having Create Session privileges can exploit this vulnerability to inject and execute malicious SQL commands on the target server. |
||
|
Update/Patch Available The vendor, Oracle, has released an advisory addressing this vulnerability: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2009.html |
|
|
Vulnerability Details The vulnerability is due to an input validation error in function VALIDATE_REMOTE_RC of the package DBMS_REPCAT_RPC. An attacker exploiting this issue may disclose sensitive data or compromise data integrity. |
Protection Overview
By enabling this protection, SmartDefense will detect and block malformed use of the REPCAT_RPC.VALIDATE_REMOTE_RC function over Oracle traffic.
To configure the defense, select your product from the list below and follow the related protection steps.