VulnerabilityModified
CVE-2004-1363
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
CRITICAL 9.8EPSS 9.10%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 9.10% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-131
- Affected
- oracle/application server · oracle/collaboration suite · oracle/database server · oracle/e-business suite · oracle/enterprise manager · oracle/enterprise manager database control · oracle/enterprise manager grid control
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=110382345829397&w=2Mailing List
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1Broken Link
- http://www.kb.cert.org/vuls/id/316206Third Party Advisory, US Government Resource
- http://www.ngssoftware.com/advisories/oracle23122004.txtBroken Link, Patch, Vendor Advisory
- http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfBroken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/10871Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA04-245A.htmlBroken Link, Patch, Third Party Advisory, US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18659Third Party Advisory, VDB Entry
- http://marc.info/?l=bugtraq&m=110382345829397&w=2Mailing List
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1Broken Link
- http://www.kb.cert.org/vuls/id/316206Third Party Advisory, US Government Resource
- http://www.ngssoftware.com/advisories/oracle23122004.txtBroken Link, Patch, Vendor Advisory
- http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfBroken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/10871Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA04-245A.htmlBroken Link, Patch, Third Party Advisory, US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18659Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.