CVE-2008-1811

Related Files

iDEFENSE Security Advisory 2008-04-15.1

Posted Apr 16, 2008

Authored by iDefense Labs, Joxean Koret | Site idefense.com

iDefense Security Advisory 04.15.08 - Local exploitation of a design error vulnerability in Oracle Corp.'s Application Express web application development tool allows attackers to gain elevated privileges. The vulnerability exists in "run_ddl" function within the "wwv_execute_immediate" package. This package is included in the "flows_030000" schema. This function allows attackers to execute SQL commands as any database user, such as SYS. iDefense confirmed the existence of this vulnerability in Oracle Application Express version 3.0.1.00.08, which is installed by default with Oracle Database 11g R1 (version 11.1.0.6.0). Previous versions may also be affected. However, Oracle Database 10g R2 does not install Oracle Application Express by default.

tags | advisory, web, local

advisories | CVE-2008-1811

SHA-256 | e62655ecf9cf417e237bbdfa2451137b6da01ab4c98426bae246e30ac759b70b

Download | Favorite | View