| Vulnerability Name: | CCN-17253 | ||||||
| Published: | 2004-09-01 | ||||||
| Updated: | 2004-09-01 | ||||||
| Summary: | Oracle Database Servers are vulnerable to a buffer overflow in the VERIFY_QUEUE_TYPES_NO_QUEUE procedure of the DBMS_AQADM package. By supplying a long SRC_QUEUE_NAME parameter to the VERIFY_QUEUE_TYPES_NO_QUEUE procedure, a remote attacker, within the EXECUTE_CATALOG_ROLE, IMP_FULL_DATABASE, IMP_FULL_DATABASE, QS_ADM, QS, QS_WS, QS_ES, QS_OS, QS_CBADM, QS_CB, QS_CS, or SYSDBA role, or that has execute permissions on the package, could overflow a buffer and cause the Oracle server process to crash or execute arbitrary code on the system. | ||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: SHATTER Team Security Alert #29 Buffer overflow in procedure VERIFY_QUEUE_TYPES_NO_QUEUE of DBMS_AQADM package Source: CCN Type: CIAC Information Bulletin 0-209 Oracle Database Server Vulnerabilities Source: CCN Type: US-CERT VU#170830 Oracle Enterprise Manager contains several vulnerabilities Source: CCN Type: Oracle Security Alert #68 This security alert addresses security vulnerabilities in Oracles server products. Source: CCN Type: BID-10871 Oracle Multiple Unspecified Vulnerabilities Source: XF Type: UNKNOWN oracle-srcqueuename-noqueue-bo(17253) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||