PT-2004-2280 · Oracle · Oracle 10G

David Litchfield · Published 2004-08-04 · Updated 2024-02-02 · CVE-2004-1363

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Oracle 10g

Description: A buffer overflow issue exists in the extproc component, allowing remote attackers to execute arbitrary code. This is achieved by manipulating environment variables in the library name, which are expanded after the length check is performed.

Recommendations: For Oracle 10g, consider restricting access to the extproc component until a fix is available. As a temporary workaround, avoid using environment variables in library names to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2004-1363

Affected Products

Oracle 10G

References · 10

• http://ngssoftware.com/advisories/oracle23122004.txt · Vendor Advisory
• http://securityfocus.com/bid/10871 · Patch
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA04-245A.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1363 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110382345829397&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18659 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1363 · Note
• http://kb.cert.org/vuls/id/316206 · Note