NGSSoftware Insight Security Research Advisory – Oracle has just released a fix for a flaw that, when exploited, allows a low privileged authenticated database user to gain MDSYS privileges. This can be abused by an attacker to perform actions as the MDSYS user. MDSYS.SDO_TOPO_DROP_FTBL is one of the triggers that forms part of the Oracle Spatial Application. It is vulnerable to SQL injection. When a user drops a table the trigger fires. The name of the table is embedded in a dynamic SQL query which is then executed by the trigger. Note that the Oracle advisory states that the attacker requires the DROP TABLE and CREATE PROCEDURE privileges. This is not the case and only CREATE SESSION privileges are required.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/73817/NISR13012009.txt
Source: https://packetstormsecurity.com/files/73817/NGSSoftware-Insight-Security-Research-Advisory-NISR13012009.html