Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Oracle Database Server Permissions Privileges and Access Controls Vulnerability - CVE-2008-6065 - Vulnerability Database
Oracle Database Server

Oracle Database Server Permissions Privileges and Access Controls Vulnerability - CVE-2008-6065

Medium
Reference: CVE-2008-6065
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2008-6065
Title: Oracle Database Server Permissions Privileges and Access Controls Vulnerability
Overview:

Oracle Database Server 10.1 10.2 and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory and then overwriting the password file through UTL_FILE operations a related issue to CVE-2006-7141.