CVE-2003-0634: Buffer Overflow

Published Aug 2, 2003

Updated

Stack-based buffer overflow in the PL/SQL EXTPROC functionality for Oracle9i Database Release 2 and 1, and Oracle 8i, allows authenticated database users, and arbitrary database users in some cases, to execute arbitrary code via a long library name.

Affected Software

29 affected components

Oracle Database=enterprise_8.1.5_.0.0

Oracle Database=enterprise_8.1.5_.0.2

Oracle Database=enterprise_8.1.5_.1.0

Oracle Database=enterprise_8.1.6_.0.0

Oracle Database=enterprise_8.1.6_.1.0

Oracle Database=enterprise_8.1.7_.0.0

Oracle Database=enterprise_8.1.7_.1.0

Oracle Database=standard_8.1.5

Oracle Database=standard_8.1.6

Oracle Database=standard_8.1.7

Oracle Database=standard_8.1.7_.0.0

Oracle Database=standard_8.1.7_.1

Oracle Database=standard_8.1.7_.4

Oracle Database=client_9.2.0.1

Oracle Database=client_9.2.0.2

Oracle Database=enterprise_9.0.1

Oracle Database=enterprise_9.2.0.1

Oracle Database=enterprise_9.2.0.2

Oracle Database=personal_9.0.1

Oracle Database=personal_9.2.0.1

Oracle Database=personal_9.2.0.2

Oracle Database=standard_9.0

Oracle Database=standard_9.0.1

Oracle Database=standard_9.0.1.2

Oracle Database=standard_9.0.1.3

Oracle Database=standard_9.0.1.4

Oracle Database=standard_9.0.2

Oracle Database=standard_9.2.0.1

Oracle Database=standard_9.2.0.2

Remediation

Patch Available

http://www.securityfocus.com/bid/8267

Event History

Aug 2, 2003

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Aug 27, 2003

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2003-0634?

CVE-2003-0634 has a high severity rating due to its potential for allowing authenticated and arbitrary database users to execute arbitrary code.

How do I fix CVE-2003-0634?

To mitigate CVE-2003-0634, it is recommended to apply the relevant security patches provided by Oracle for affected versions of Oracle Database.

Which Oracle products are affected by CVE-2003-0634?

CVE-2003-0634 affects various versions of Oracle8i and Oracle9i, including both standard and enterprise editions.

Can CVE-2003-0634 be exploited remotely?

Exploitability of CVE-2003-0634 is possible if an attacker has network access to the vulnerable Oracle database and valid authentication.

What is the impact of CVE-2003-0634 on system security?

The impact of CVE-2003-0634 includes the potential for arbitrary code execution, which can compromise the integrity and confidentiality of the database.