CVE-2003-0222 Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connec...
HighCVSS 9.0
EPSS 11.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle database server | = 7.3.3 | No fix listed |
| oracle database server | = 7.3.4 | No fix listed |
| oracle database server | = 8.0.1 | No fix listed |
| oracle database server | = 8.0.2 | No fix listed |
| oracle database server | = 8.0.3 | No fix listed |
| oracle database server | = 8.0.4 | No fix listed |
| oracle database server | = 8.0.5 | No fix listed |
| oracle database server | = 8.0.5.1 | No fix listed |
| oracle database server | = 8.0.6 | No fix listed |
| oracle database server | = 8.1.5 | No fix listed |
| oracle database server | = 8.1.6 | No fix listed |
| oracle database server | = 8.1.7 | No fix listed |
| oracle database server | = 9.2.1 | No fix listed |
| oracle database server | = 9.2.2 | No fix listed |
| oracle8i | = 8.0.6 | No fix listed |
| oracle8i | = 8.0.6.3 | No fix listed |
| oracle8i | = 8.0x | No fix listed |
| oracle8i | = 8.1.5 | No fix listed |
| oracle8i | = 8.1.6 | No fix listed |
| oracle8i | = 8.1.7 | No fix listed |
| oracle8i | = 8.1.7.1 | No fix listed |
| oracle8i | = 8.1.7.4 | No fix listed |
| oracle8i | = 8.1x | No fix listed |
| oracle9i | = 9.0 | No fix listed |
| oracle9i | = 9.0.1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle9i | = 9.0.1.2 | No fix listed |
| oracle9i | = 9.0.1.3 | No fix listed |
| oracle9i | = 9.0.1.4 | No fix listed |
| oracle9i | = 9.0.2 | No fix listed |
| oracle9i | = 9.2.0.1 | No fix listed |
| oracle9i | = 9.2.0.2 | No fix listed |
References
- 20030429 Oracle Database Server Buffer Overflow Vulnerability (#NISR29042003) mailing-list
- 20030429 Oracle Database Server Buffer Overflow Vulnerability (#NISR29042003) mailing-list
- otn.oracle.com patch vendor-advisory
- N-085 government-resource third-party-advisory
- 7453 patch vdb-entry vendor-advisory
- oracle-database-link-bo(11885) vdb-entry