PT-2004-1730 · Oracle · Oracle 9I Database Server+1

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-0638

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle 9i Database Server versions 9.0.1.4 through 9.0.1.5 Oracle 9i Database Server versions 9.2.0.3 through 9.2.0.4 Oracle 8i Database Server version 8.1.7.4

Description A buffer overflow issue exists in the KSDWRTB function within the dbms system package. This allows remote authorized users to execute arbitrary code by providing a long second argument to the ksdwrt function.

Recommendations For Oracle 9i Database Server versions 9.0.1.4 through 9.0.1.5, update to a version that includes the fix for this issue. For Oracle 9i Database Server versions 9.2.0.3 through 9.2.0.4, update to a version that includes the fix for this issue. For Oracle 8i Database Server version 8.1.7.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the dbms system.ksdwrt function until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2004-0638

Produtos afetados

Oracle 8I Database Server

Oracle 9I Database Server

Referências · 7

• http://idefense.com/application/poi/display?id=135&type=vulnerabilities&flashstatus=false · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0638 · Nota de Segurança
• http://red-database-security.com/advisory/advisory_20040903_3.htm · Aviso do Fabricante
• http://securityfocus.com/bid/11100 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17254 · Nota
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Aviso do Fabricante
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0178.html · Aviso do Fabricante