CVE-2003-0095: Buffer Overflow

Published Mar 3, 2003

Updated

Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login, as exploitable through client applications that perform their own authentication, as demonstrated using LOADPSP.

Affected Software

10 affected components

Oracle Database Server=8.0.6

Oracle Database Server=9.2.1

Oracle Database Server=9.2.2

Oracle Oracle8i=8.1.7

Oracle Oracle8i=8.1.7.1

Oracle Oracle9i=9.0

Oracle Oracle9i=9.0.1

Oracle Oracle9i=9.0.1.2

Oracle Oracle9i=9.0.1.3

Oracle Oracle9i=9.0.2

Remediation

Patch Available

http://otn.oracle.com/deploy/security/pdf/2003alert51.pdf

Event History

Mar 3, 2003

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityWeaknessAffected Software

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-0095?

CVE-2003-0095 has a high severity level due to its potential to allow remote attackers to execute arbitrary code.

How do I fix CVE-2003-0095?

To fix CVE-2003-0095, it is recommended to apply the latest patches provided by Oracle for the affected database versions.

What versions are affected by CVE-2003-0095?

CVE-2003-0095 affects Oracle Database Server versions 9i, 8i, and several other variations prior to version 9.2.

Can CVE-2003-0095 be exploited remotely?

Yes, CVE-2003-0095 can be exploited remotely through a crafted long username during the authentication process.

What is the nature of the vulnerability in CVE-2003-0095?

The vulnerability in CVE-2003-0095 is a buffer overflow in the ORACLE.EXE component of Oracle Database Server.