Description
Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.
Products
- Oracle Database Server 7.3.3
- Oracle Database Server 7.3.4
- Oracle Database Server 8.0.1
- Oracle Database Server 8.0.2
- Oracle Database Server 8.0.3
- Oracle Database Server 8.0.4
- Oracle Database Server 8.0.5.1
- Oracle Database Server 8.0.5
- Oracle Database Server 8.0.6
- Oracle Database Server 8.1.5
- Oracle Database Server 8.1.6
- Oracle Database Server 8.1.7
- Oracle Database Server 8.1.7 Release 1
- Oracle Database Server 9.2.1
- Oracle Database Server 9.2.2
- Oracle 8i 8.0.6.3
- Oracle 8i 8.0.6
- Oracle 8i 8.0x
- Oracle 8i 8.1.5
- Oracle 8i 8.1.6
- Oracle 8i 8.1.7.1
- Oracle 8i 8.1.7.4
- Oracle 8i 8.1.7
- Oracle 8i 8.1x
- Oracle 9i 9.0.1.2
- Oracle 9i 9.0.1.3
- Oracle 9i 9.0.1.4
- Oracle 9i 9.0.1
- Oracle 9i 9.0.2
- Oracle 9i 9.0
- Oracle 9i 9.2.0.1
- Oracle 9i 9.2.0.2
Questions to Ask Vendors
- Can you confirm whether your systems are affected by CVE-2003-0222, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2003-0222 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions
- Check out the advisory links provided below.
References