CVE-2011-2322

Related Files

Oracle Database Account Management Protection Bypass

Posted Oct 21, 2011

Authored by Esteban Martinez Fayo | Site appsecinc.com

Team SHATTER Security Advisory - Oracle Database Vault provides additional protections from malicious privileged users. The protections include separation of duty for some tasks like user account management. Any user with SYSDBA privilege or DV_ACCTMGR role can bypass these protections and change any user's password (including Oracle Database Vault Owner user password) calling the OCIPasswordChange client API (the 'password' command in SqlPLUS uses this API).

tags | advisory, bypass

advisories | CVE-2011-2322, CVE-2011-3511

SHA-256 | 08eb0063be1a9f53dacc8a42dfd1b62599503ff8a01981427d4b037d0ff49eff

Download | Favorite | View