发布日期：2006-07-18
更新日期：2007-03-27

受影响系统：

Oracle Oracle8i 8.1.7.4
Oracle Oracle9i 9.2.0.7
Oracle Oracle9i 9.2.0.6
Oracle E-Business Suite 11i 11.5.7 - 11.5.10 CU2
Oracle E-Business Suite 11.0
Oracle Enterprise Manager 10g Grid Control, v10.2.0.1
Oracle Database 10g Release 1 10.1.0.5
Oracle Database 10g Release 1 10.1.0.4
Oracle Collaboration Suite Release 2 9.0.4.2
Oracle Application Server 10g Release 2 10.1.2.1.0
Oracle Application Server 10g Release 2 10.1.2.0.0 - 10.1.2.0.2
Oracle Application Server 10g Release 1 (9.0.4) 9.0.4.3
Oracle Application Server 10g Release 1 (9.0.4) 9.0.4.2
Oracle Collaboration Suite 10g Release 1 10.1.2.0
Oracle Database 10g Release 2 10.2.0.2
Oracle Database 10g Release 2 10.2.0.1
Oracle Pharmaceutical Applications 4.5.0 - 4.5.2
Oracle JD Edwards EnterpriseOne Tools/OneWorld Tools 8.96
Oracle JD Edwards EnterpriseOne Tools/OneWorld Tools 8.95
Oracle Application Server 10g Release 3 10.1.3.0.0
Oracle PeopleSoft Enterprise Portal Solutions Enterprise Portal,8.9
Oracle PeopleSoft Enterprise Portal Solutions Enterprise Portal,8.8
Oracle PeopleSoft Enterprise Portal Solutions Enterprise Portal,8.4

描述：

---

BUGTRAQ  ID: 19054
CVE ID: CVE-2006-3698,CVE-2006-3699,CVE-2006-3700,CVE-2006-3701,CVE-2006-3702,CVE-2006-3703,CVE-2006-3704,CVE-2006-3705,CVE-2006-3706,CVE-2006-3707,CVE-2006-3708,CVE-2006-3709,CVE-2006-3710,CVE-2006-3711,CVE-2006-3712,CVE-2006-3713,CVE-2006-3714,CVE-2006-3715,CVE-2006-3716,CVE-2006-3717,CVE-2006-3718,CVE-2006-3719,CVE-2006-3720,CVE-2006-3721,CVE-2006-3722,CVE-2006-3723,CVE-2006-3724

Oracle Database是一款商业性质大型数据库系统。

Oracle发布了2006年7月的紧急补丁更新公告，修复了多个Oracle产品中的多个漏洞。这些漏洞影响Oracle产品的所有安全属性，可导致本地和远程的威胁。其中一些漏洞可能需要各种级别的授权，但也有些不需要任何授权。最严重的漏洞可能导致完全入侵数据库系统。

<*来源：Esteban Martinez Fayo
        Dr. Christian Kleinewaechter
        Swen Thuemmler
        Alexander Kornbrust （ak@red-database-security.com）
        David Litchfield
  
  链接：http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_stats.html
        http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_upgrade.html
        http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_cdc_impdp.html
        http://www.red-database-security.com/advisory/oracle_sql_injection_kupw$worker.html
        http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

http://www.milw0rm.com/exploits/3358
http://www.milw0rm.com/exploits/3375
http://www.milw0rm.com/exploits/3585
http://www.milw0rm.com/exploits/3584

建议：

---

厂商补丁：

Oracle
------
Oracle已经为此发布了一个安全公告（cpujul2006）以及相应补丁:
cpujul2006：Oracle Critical Patch Update - July 2006
链接：http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html?_template=/o

浏览次数：5624
严重程度：0（网友投票）