PT-2003-1363 · Oracle · Oracle Database Server

Mark Litchfield · Publicado 2003-03-03 · Atualizado 2016-10-18 · CVE-2003-0095

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 8.0.6 through 9i

Description A buffer overflow issue exists in the ORACLE.EXE component, allowing remote attackers to execute arbitrary code by providing a long username during the login process. This can be exploited through client applications that handle their own authentication, as shown using the LOADPSP method.

Recommendations For Oracle Database Server versions 8.0.6 through 9i, consider restricting access to the authentication mechanism to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the length of the username parameter to prevent buffer overflow.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2003-0095

Produtos afetados

Oracle Database Server

Referências · 10

• http://osvdb.org/6319 · Nota
• http://kb.cert.org/vuls/id/953746 · Nota
• http://cert.org/advisories/CA-2003-05.html · Nota
• http://marc.info/?l=bugtraq&m=104549693426042&w=2 · Nota
• http://securityfocus.com/bid/6849 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0095 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0095 · Nota
• http://ciac.org/ciac/bulletins/n-046.shtml · Nota
• http://otn.oracle.com/deploy/security/pdf/2003alert51.pdf · Aviso do Fabricante
• http://iss.net/security_center/static/11328.php · Aviso do Fabricante