PT-2003-1363 · Oracle · Oracle Database Server

Mark Litchfield · Published 2003-03-03 · Updated 2016-10-18 · CVE-2003-0095

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 8.0.6 through 9i

Description A buffer overflow issue exists in the ORACLE.EXE component, allowing remote attackers to execute arbitrary code by providing a long username during the login process. This can be exploited through client applications that handle their own authentication, as shown using the LOADPSP method.

Recommendations For Oracle Database Server versions 8.0.6 through 9i, consider restricting access to the authentication mechanism to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the length of the username parameter to prevent buffer overflow.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2003-0095

Affected Products

Oracle Database Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2003-0095 · Security Note
• http://otn.oracle.com/deploy/security/pdf/2003alert51.pdf · Vendor Advisory
• http://iss.net/security_center/static/11328.php · Vendor Advisory
• http://osvdb.org/6319 · Note
• http://kb.cert.org/vuls/id/953746 · Note
• http://cert.org/advisories/CA-2003-05.html · Note
• http://marc.info/?l=bugtraq&m=104549693426042&w=2 · Note
• http://securityfocus.com/bid/6849 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0095 · Note
• http://ciac.org/ciac/bulletins/n-046.shtml · Note