PT-1999-1651 · Oracle · Db

Published 1999-12-31 · Updated 2016-10-18 · CVE-1999-1330

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: db library version 1.85.4

Description: The issue concerns the snprintf function in the db library, which fails to properly implement the size parameter. This oversight could enable attackers to exploit buffer overflows that would otherwise be prevented by a correctly implemented snprintf function.

Recommendations: For db library version 1.85.4, consider disabling the use of the snprintf function until a patch is available that properly implements the size parameter to prevent buffer overflows.

Fix

Related Identifiers

CVE-1999-1330

Affected Products

Db

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1330 · Security Note
• http://lists.openresources.com/Debian/debian-bugs-closed/msg00581.html · Note
• http://iss.net/security_center/static/7244.php · Note
• http://redhat.com/support/errata/rh42-errata-general.html#db · Note
• http://marc.info/?l=bugtraq&m=87602661419259&w=2 · Note