CVE-2003-0096
Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 15.93% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- oracle/database server · oracle/oracle8i · oracle/oracle9i
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0073.html
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0075.html
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0083.html
- http://marc.info/?l=bugtraq&m=104549743326864&w=2
- http://marc.info/?l=bugtraq&m=104549782327321&w=2
- http://marc.info/?l=bugtraq&m=104550346303295&w=2
- http://otn.oracle.com/deploy/security/pdf/2003alert48.pdf
- http://otn.oracle.com/deploy/security/pdf/2003alert49.pdf
- http://otn.oracle.com/deploy/security/pdf/2003alert50.pdf
- http://www.cert.org/advisories/CA-2003-05.htmlUS Government Resource
- http://www.ciac.org/ciac/bulletins/n-046.shtml
- http://www.iss.net/security_center/static/11325.php
- http://www.iss.net/security_center/static/11326.php
- http://www.iss.net/security_center/static/11327.phpVendor Advisory
- http://www.kb.cert.org/vuls/id/663786US Government Resource
- http://www.kb.cert.org/vuls/id/743954US Government Resource
- http://www.kb.cert.org/vuls/id/840666Third Party Advisory, US Government Resource
- http://www.nextgenss.com/advisories/ora-bfilebo.txt
- http://www.nextgenss.com/advisories/ora-tmstmpbo.txt
- http://www.nextgenss.com/advisories/ora-tzofstbo.txt
- http://www.securityfocus.com/bid/6847
- http://www.securityfocus.com/bid/6848
- http://www.securityfocus.com/bid/6850
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0073.html
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0075.html
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0083.html
- http://marc.info/?l=bugtraq&m=104549743326864&w=2
- http://marc.info/?l=bugtraq&m=104549782327321&w=2
- http://marc.info/?l=bugtraq&m=104550346303295&w=2
- http://otn.oracle.com/deploy/security/pdf/2003alert48.pdf
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.