CVE-2006-0286

Vulnerability

An unspecified vulnerability exists in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Oracle Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2 [1]. Details of the underlying weakness have not been disclosed; the issue is identified by Oracle Vuln# OHS01 [1].

Exploitation

The specific attack vectors and preconditions required to exploit this vulnerability are not described in the available references [1]. The CERT/CC note states that the conditions necessary to exploit these vulnerabilities are unavailable [1]. It is unknown whether authentication, network access, or user interaction is required.

Impact

The full impact of this vulnerability is unspecified, but according to the CERT/CC, Oracle product vulnerabilities may result in remote execution of arbitrary code, disclosure of sensitive information, or denial-of-service conditions [1]. Database compromises could lead to exposure of sensitive personal information such as credit card numbers, social security numbers, and health data [1].

Mitigation

Oracle released a Critical Patch Update for January 2006 to address this and other vulnerabilities [1]. Affected users should apply the appropriate patches from Oracle as specified in that update [1]. No workarounds are documented in the available references.