{"vuid":"VU#805737","idnumber":"805737","name":"Oracle views fail to enforce table security settings","keywords":["Oracle","unauthorized data modification","SELECT Object Privilege","base table","oracle_cpu_january_2006"],"overview":"A vulnerability in the way Oracle handles views may allow an attacker to modify privileged database information.","clean_desc":"Database Views A view is a queryable aggregation of data from one or more tables that is stored and maintained. The Problem A vulnerability in the way that Oracle handles specially crafted views may allow an attacker to bypass Oracle security settings and modify the underlying tables on which the view is built. Originally, it was believed that an attacker must have the CREATE VIEW privilege and SELECT privileges on certain tables to exploit this vulnerability. However, according to public sources, the CREATE VIEW privilege is not needed. Note that exploit code for this issue is publicly available.","impact":"A remote attacker may be able to execute arbitrary SQL statements with elevated privileges. This may allow the attacker to access and modify sensitive information within an Oracle database.","resolution":"Apply Updates \nWe believe this issue is addressed in the Oracle Critical Patch Update for January 2006.","workarounds":"Until the update for this issue can be applied, the following workarounds may reduce the chances of exploitation. Use Least Privilege Where possible, grant users the fewest privileges needed to perform necessary tasks. Adding or removing privileges from roles may impact system functionality. Instead, privileges should be administered on a per-user basis. Change login credentials for default Oracle accounts Oracle creates numerous default accounts when it is installed. Upon installation, accounts that are not needed should be disabled and the login credentials for needed accounts should be changed.","sysaffected":"","thanks":"This vulnerability was reported by Alexander Kornbrust of \nRed Database Security\n. Red Database Security credits \nJens Flasche, Dr. Christian Kleinewächter, and Swen Thümmler with providing information regarding this issue. Information used in this document came from \nOracle","author":"This document was written by Jeff Gennari and Stephen Rhoton.","public":["http://www.red-database-security.com/advisory/oracle_modify_data_via_views.html","http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database.pdf","http://www.oracle.com/technology/deploy/security/db_security/htdocs/eus.html","http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html","http://andrewmax.blogspot.com/2006/04/yet-another-security-alert.html"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-04-10T16:19:14Z","publicdate":"2006-04-06T00:00:00Z","datefirstpublished":"2006-05-03T16:11:34Z","dateupdated":"2007-01-03T14:45:07Z","revision":107,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"5","cam_internetinfrastructure":"5","cam_population":"15","cam_impact":"20","cam_easeofexploitation":"10","cam_attackeraccessrequired":"9","cam_scorecurrent":"12.65625","cam_scorecurrentwidelyknown":"15.1875","cam_scorecurrentwidelyknownexploited":"22.78125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":12.65625,"vulnote":null}