Signature Detail

DB: Oracle ctxsys.driload Access

This signature detects attempts to access a function in Oracle that has known vulnerabilities. This function is typically disabled; when enabled, attackers can use it to compromise the Oracle DB server.

Extended Description

Oracle Database Server is prone to an access validation vulnerability that may permit unprivileged users to execute commands as the DBA. This could compromise the database. This issue corresponds to one of the unspecified vulnerabilities mentioned in BID 10871 and addressed by Oracle Alert #68.

Affected Products

• Oracle Oracle8i Enterprise Edition 8.1.7.4.0
• Oracle Oracle8i Standard Edition 8.1.7 .4
• Oracle Oracle9i Enterprise Edition 9.0.0 .2.4
• Oracle Oracle9i Personal Edition 9.0.0 .2.4
• Oracle Oracle9i Standard Edition 9.0.0 .2.4
• Oracle Oracle9i Standard Edition 9.0.1 .3

References

• BugTraq: 11099
• CVE: CVE-2004-0637
• URL: http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
• URL: http://www.idefense.com/application/poi/display?id=136&type=vulnerabilities&flashstatus=false
• URL: http://secunia.com/advisories/12409/