CVE-2006-7141

View on CVE.org

Published Mar 7, 2007 CVSS 2.0 · 6.0 Medium EPSS 5.9% KEV · Not listed

Description

Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or "CREATE ANY DIRECTORY to PUBLIC" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701. NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: 5.9% (5.934% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.0xdeadbeef.info/exploits/raptor_orafile.sql
http://www.securityfocus.com/archive/1/454862/100/0/threaded
http://www.securityfocus.com/archive/1/454964/100/0/threaded
http://www.securityfocus.com/archive/1/455047/100/0/threaded

History

No history.

Subscriptions

Oracle Database Server

Weaknesses

NVD-CWE-Other

Sources

CVE record Updated: Aug 7, 2024, 8:50 PM

Status: PUBLISHED
Assigner: mitre
Published: Mar 7, 2007, 8:00 PM
Updated: Aug 7, 2024, 8:50 PM
Reserved: Mar 7, 2007, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 16, 2026, 10:34 PM

Status: Modified
Published: Mar 7, 2007, 8:19 PM
Modified: Jun 16, 2026, 10:34 PM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-12-19T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or \"CREATE ANY DIRECTORY to PUBLIC\" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701. NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql"}, {"name": "20061221 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded"}, {"name": "20061220 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded"}, {"name": "20061219 Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-7141", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or \"CREATE ANY DIRECTORY to PUBLIC\" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701. NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql", "refsource": "MISC", "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql"}, {"name": "20061221 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded"}, {"name": "20061220 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded"}, {"name": "20061219 Oracle <= 9i / 10g File System Access via utl_file Exploit", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:50:06.089Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql"}, {"name": "20061221 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded"}, {"name": "20061220 Re: Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded"}, {"name": "20061219 Oracle <= 9i / 10g File System Access via utl_file Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-7141", "datePublished": "2007-03-07T20:00:00.000Z", "dateReserved": "2007-03-07T00:00:00.000Z", "dateUpdated": "2024-08-07T20:50:06.089Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A77562B-D1A5-450D-9288-3FC7145E9292", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or \"CREATE ANY DIRECTORY to PUBLIC\" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701. NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability"}, {"lang": "es", "value": "** IMPUGNADO ** Vulnerabilidad de escalado de ruta en el Servidor de Base de Datos Oracle, cuando el utl_file_dir est\u00e1 establecido a un valor comod\u00edn o existen privilegios de \"CREATE ANY DIRECTORY to PUBLIC\", permite a usuarios remotos autenticados leer y modificar ficheros de su elecci\u00f3n pasando rutas completas de ficheros a la funci\u00f3n utl_file como la (1) utl_file.put_line y(2) utl_file.get_line, vulnerabilidad relacionada con la CVE-2005-0701. NOTA: esta vulnerabilidad est\u00e1 impugnada por terceras partes que determinan que esto se debe a una configuraci\u00f3n insegura en vez de ser propiamente una vulnerabilidad."}], "id": "CVE-2006-7141", "lastModified": "2026-06-16T22:34:27.397", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-03-07T20:19:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}