| Vulnerability Name: | CCN-17261 | ||||||
| Published: | 2004-09-01 | ||||||
| Updated: | 2004-09-01 | ||||||
| Summary: | Oracle Database Servers are vulnerable to a buffer overflow in the VALIDATE procedure of the DBMS_INTERNAL_REPCAT package. By supplying a long GNAME parameter to the VALIDATE procedure, a remote attacker, within the EXECUTE_CATALOG_ROLE, IMP_FULL_DATABASE, IMP_FULL_DATABASE, QS_ADM, QS, QS_WS, QS_ES, QS_OS, QS_CBADM, QS_CB, QS_CS, or SYSDBA role or that has execute permissions on the package, could overflow a buffer and cause the Oracle server process to crash or execute arbitrary code on the system. | ||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: SHATTER Team Security Alert #35 Buffer overflow in procedure VALIDATE of DBMS_INTERNAL_REPCAT package Source: CCN Type: CIAC Information Bulletin 0-209 Oracle Database Server Vulnerabilities Source: CCN Type: US-CERT VU#170830 Oracle Enterprise Manager contains several vulnerabilities Source: CCN Type: Oracle Security Alert #68 This security alert addresses security vulnerabilities in Oracles server products. Source: CCN Type: BID-10871 Oracle Multiple Unspecified Vulnerabilities Source: XF Type: UNKNOWN oracle-gname-validate-bo(17261) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||