Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-1991 | First vendor Publication | 2009-10-22 |
| Vendor | Cve | Last vendor Modification | 2012-10-23 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:H/Au:S/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 3.6 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | High |
| Cvss Expoit Score | 3.9 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an established researcher that this is for multiple SQL injection vulnerabilities via the (1) idx_owner or (2) idx_name parameters to the create_tables procedure. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1991 |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 59113 | Oracle Database Text ctxsys.drvxtabc.create_tables Multiple Parameter SQL Inj... Oracle Database Text contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the ctxsys.drvxtabc.create_tables script not properly sanitizing user-supplied input to the 'idx_owner' and 'idx_name' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Oracle database server CREATE_TABLES SQL injection attempt RuleID : 16290 - Revision : 4 - Type : SERVER-ORACLE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-11-16 | Name : The remote database server is affected by multiple vulnerabilities. File : oracle_rdbms_cpu_oct_2009.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:09:41 |
|
| 2021-04-22 01:10:01 |
|
| 2020-05-23 00:23:54 |
|
| 2016-06-28 17:43:39 |
|
| 2016-04-26 18:53:10 |
|
| 2014-02-17 10:50:27 |
|
| 2014-01-19 21:25:58 |
|
| 2013-05-10 23:52:04 |
|
