| Vulnerability Name: | CCN-17241 | ||||||
| Published: | 2004-09-01 | ||||||
| Updated: | 2004-09-01 | ||||||
| Summary: | Oracle Database Servers are vulnerable to a buffer overflow in the DBMS_REPCAT package, which is used to administer and update the replication environment and catalog. By supplying a long fname parameter to certain procedures within the DBMS_REPCAT package, a remote attacker, with EXECUTE_CATALOG_ROLE or SYSDBA member role permissions or that has execute permissions on the package, could overflow a buffer and cause the Oracle server process to crash or execute arbitrary code on the system. | ||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: SHATTER Team Security Alert #24 Buffer overflow on "fname" parameter of the DBMS_REPCAT* packages Source: CCN Type: CIAC Information Bulletin 0-209 Oracle Database Server Vulnerabilities Source: CCN Type: US-CERT VU#170830 Oracle Enterprise Manager contains several vulnerabilities Source: CCN Type: Oracle Security Alert #68 This security alert addresses security vulnerabilities in Oracles server products. Source: CCN Type: BID-10871 Oracle Multiple Unspecified Vulnerabilities Source: XF Type: UNKNOWN oracle-fname-dbmsrepcat-bo(17241) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||