CVE-2004-1338

Vulnerability

In Oracle Database 9i and 10g, the default trigger SDO_CMT_CBK_TRIG owned by MDSYS fires upon DELETE operations on the SDO_TXN_IDX_INSERTS table. This trigger selects and executes a list of functions from the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE tables. Although PUBLIC does not have direct INSERT privileges on those tables, the MDSYS package PRVT_CMT_CBK exposes procedures CCBKAPPLROWTRIG and EXEC_CBK_FN_DML that accept a schema and function name, which then get inserted into the aforementioned tables [1].

Exploitation

A local user with minimal privileges can craft a malicious PL/SQL function (or reuse an existing one owned by a privileged user). By calling CCBKAPPLROWTRIG or EXEC_CBK_FN_DML with the schema and name of that function, the attacker inserts the function reference into SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE. Subsequently, performing a DELETE on SDO_TXN_IDX_INSERTS causes the SDO_CMT_CBK_TRIG trigger to fire and execute the attacker-specified function with MDSYS privileges [1].

Impact

Upon successful execution, the attacker's arbitrary PL/SQL function runs with the elevated privileges of the trigger owner (MDSYS). This can lead to full compromise of the Oracle database, including unauthorized data access, modification, or destruction. The attack can also be leveraged to gain operating‑system level privileges if the Oracle software runs with high OS rights [1].

Mitigation

Oracle released a patch for this issue as part of the Critical Patch Update program. The vendor advisory recommends applying the relevant patch for Oracle 9i and 10g. As a workaround, revoke PUBLIC execution on the PRVT_CMT_CBK package and DELETE on SDO_TXN_IDX_INSERTS if business requirements allow. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog [1].