Vulnerability CVE-2003-0634 - CERT Civis.Net

Vulnerability Name:

CVE-2003-0634 (CCN-12721)

Assigned:

2003-07-23

Published:

2003-07-23

Updated:

2017-07-11

Summary:

Stack-based buffer overflow in the PL/SQL EXTPROC functionality for Oracle9i Database Release 2 and 1, and Oracle 8i, allows authenticated database users, and arbitrary database users in some cases, to execute arbitrary code via a long library name.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Sat Jul 26 2003 - 07:05:03 CDT
Re: question about oracle advisory

Source: VULNWATCH
Type: UNKNOWN
20030912 Update to the Oracle EXTPROC advisory

Source: MITRE
Type: CNA
CVE-2003-0634

Source: BUGTRAQ
Type: UNKNOWN
20030725 Oracle Extproc Buffer Overflow (#NISR25072003)

Source: BUGTRAQ
Type: UNKNOWN
20030725 question about oracle advisory

Source: NTBUGTRAQ
Type: UNKNOWN
20030725 Oracle Extproc Buffer Overflow (#NISR25072003)

Source: CCN
Type: Oracle Security Alert #57
Buffer Overflows in EXTPROC of Oracle Database Server

Source: CONFIRM
Type: UNKNOWN
http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf

Source: CCN
Type: CIAC Information Bulletin N-127
Buffer Overflows in EXTPROC of Oracle Database Server

Source: CCN
Type: US-CERT VU#936868
Oracle Database Server contains stack overflow in logging mechanism when supplied overly long library name

Source: CERT-VN
Type: US Government Resource
VU#936868

Source: CCN
Type: NGSSoftware Insight Security Research Advisory NISR25072003
Oracle Extproc Buffer Overflow

Source: CCN
Type: OSVDB ID: 2297
Oracle PL/SQL Package for External Procedures (EXTPROC) Functionality Library Name Overflow

Source: BID
Type: Patch, Vendor Advisory
8267

Source: CCN
Type: BID-8267
Oracle Database Server EXTPROC Buffer Overflow Vulnerability

Source: XF
Type: UNKNOWN
oracle-extproc-bo(12721)

Source: XF
Type: UNKNOWN
oracle-extproc-bo(12721)

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:oracle8i:enterprise_8.1.5_.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.5_.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.5_.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.6_.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.6_.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.7_.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:enterprise_8.1.7_.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.7_.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.7_.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle8i:standard_8.1.7_.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:client_9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:client_9.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:enterprise_9.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:enterprise_9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:enterprise_9.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:personal_9.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:personal_9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:personal_9.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:oracle9i:standard_9.2.0.2:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:database_server:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:database_server:9.0.2.4:*:*:*:*:*:*:*

Denotes that component is vulnerable