Oracle Database and Enterprise Manager Grid Control Multiple SQL Injection Vulnerabilities

Bugtraq ID:	47451
Class:	Unknown
CVE:	CVE-2011-0787
Remote:	Yes
Local:	No
Published:	Apr 19 2011 12:00AM
Updated:	May 02 2011 05:53PM
Credit:	Esteban Martinez Fayo.
Vulnerable:	Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Enterprise Edition 11.1.0.7 Oracle Enterprise Manager Grid Control 10g 10.2 .1 Oracle Enterprise Manager Grid Control 10g 10.1 6 Oracle Enterprise Manager Grid Control 10g 10.1 .5 Oracle Enterprise Manager Grid Control 10g 10.1 .4 Oracle Enterprise Manager Grid Control 10g 10.1 .3 Oracle Enterprise Manager Grid Control 10g 10.1 .0.2 Oracle Enterprise Manager Grid Control 10g 10.2.0.5 Oracle Enterprise Manager Grid Control 10g 10.2.0.4
Not Vulnerable:

Oracle Database and Enterprise Manager Grid Control Multiple SQL Injection Vulnerabilities

Oracle Database and Enterprise Manager Grid Control are prone to multiple an SQL-injection vulnerabilities in Application Service Level Management.

Exploiting these issues could allow the attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Oracle Database and Enterprise Manager Grid Control Multiple SQL Injection Vulnerabilities

An attacker can use a browser to exploit these issues.

Oracle Database and Enterprise Manager Grid Control Multiple SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Database and Enterprise Manager Grid Control Multiple SQL Injection Vulnerabilities

References:

• TeamSHATTER Security Advisory: Multiple SQL Injection in Oracle Enterprise Manag (SECLISTS.ORG)
  
• Oracle Critical Patch Update Advisory - April 2011 (Oracle)