Vulnerability in Oracle Database Server
CVE-2004-1338
The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions.
EPSS: 0.012 (66.3th percentile) — read the EPSS interpretation.
Affected products
- Oracle Database_server — versions 10.2.1
- Oracle Oracle9i — versions 9.0, 9.0.1, 9.0.1.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
- cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)