Oracle Database 10g uses a NULL pDacl parameter when calling the SetSecurityDescriptorDacl function to create discretionary access control lists (DACLs), which allows local users to gain privileges.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Database_server | Oracle | 10.2.1 (including) | 10.2.1 (including) |
| Database_server | Oracle | 10.2.2 (including) | 10.2.2 (including) |
| Database_server | Oracle | 10.2.3 (including) | 10.2.3 (including) |