Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Oracle Database Server UTL_FILE Directory Traversal File Access

Medium

Synopsis

The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files.

Description

The remote host appears to be running a vulnerable version of Oracle Database Server. An authenticated user can craft SQL queries such that they would be able to retrieve any file on the system. An attacker exploiting this flaw would need a valid account and would need to be able to connect to the Oracle service (typically on port 2972). The attacker would retrieve and/or potentially modify confidential data on the target Oracle server.

Solution

Upgrade or patch according to vendor recommendations.