CVE-2008-6065

Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY…

published February 5, 2009

CVSS
—
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory, and then overwriting the password file through UTL_FILE operations, a related issue to CVE-2006-7141.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02198 · 82.2th percentile
Published
2009-02-05T02:00Z
EPSS history
Timeline
  • 05 FEB 02:00Z
    Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY…
    cvelistv5