PT-2004-1730 · Oracle · Oracle 9I Database Server+1

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-0638

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle 9i Database Server versions 9.0.1.4 through 9.0.1.5 Oracle 9i Database Server versions 9.2.0.3 through 9.2.0.4 Oracle 8i Database Server version 8.1.7.4

Description A buffer overflow issue exists in the KSDWRTB function within the dbms system package. This allows remote authorized users to execute arbitrary code by providing a long second argument to the ksdwrt function.

Recommendations For Oracle 9i Database Server versions 9.0.1.4 through 9.0.1.5, update to a version that includes the fix for this issue. For Oracle 9i Database Server versions 9.2.0.3 through 9.2.0.4, update to a version that includes the fix for this issue. For Oracle 8i Database Server version 8.1.7.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the dbms system.ksdwrt function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2004-0638

Affected Products

Oracle 8I Database Server

Oracle 9I Database Server

References · 7

• http://idefense.com/application/poi/display?id=135&type=vulnerabilities&flashstatus=false · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0638 · Security Note
• http://red-database-security.com/advisory/advisory_20040903_3.htm · Vendor Advisory
• http://securityfocus.com/bid/11100 · Patch
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0178.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17254 · Note