The DIRECTORY objects in Oracle 8i through Oracle 10g contain the location of a specific operating system directory, which allows users with read privileges to a DIRECTORY object to obtain sensitive information.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Database_server | Oracle | 8.0.6 (including) | 8.0.6 (including) |
| Database_server | Oracle | 8.0.6.3 (including) | 8.0.6.3 (including) |
| Database_server | Oracle | 8.1.7.4 (including) | 8.1.7.4 (including) |
| Database_server | Oracle | 9.0.1.4 (including) | 9.0.1.4 (including) |
| Database_server | Oracle | 9.0.1.5 (including) | 9.0.1.5 (including) |
| Database_server | Oracle | 9.0.4 (including) | 9.0.4 (including) |
| Database_server | Oracle | 9.2.0.4 (including) | 9.2.0.4 (including) |
| Database_server | Oracle | 9.2.0.5 (including) | 9.2.0.5 (including) |
| Database_server | Oracle | 9.2.0.6 (including) | 9.2.0.6 (including) |
| Database_server | Oracle | 10.1.0.2 (including) | 10.1.0.2 (including) |
| Database_server | Oracle | 10.1.0.3 (including) | 10.1.0.3 (including) |
| Database_server | Oracle | 10.1.0.3.1 (including) | 10.1.0.3.1 (including) |
References
- http://marc.info/?l=bugtraq\u0026m=110608912525883\u0026w=2
- http://www.oracle.com/technology/deploy/security/pdf/cpu-jan-2005_advisory.pdf
- http://www.petefinnigan.com/directory_traversal.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18947
- http://marc.info/?l=bugtraq\u0026m=110608912525883\u0026w=2
- http://www.oracle.com/technology/deploy/security/pdf/cpu-jan-2005_advisory.pdf
- http://www.petefinnigan.com/directory_traversal.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18947