National Vulnerability Database (CVE-2003-0222)

National Cyber-Alert System Vulnerability Summary: CVE-2003-0222
Orirignal release date: 2003-05-12 Source: US-CERT/NIST ### Overview Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter. ### Impact CVSS Severity: 7 (High) Range: remote Authentication: input bound="1" Impact Type: sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: Oracle Name: Buffer Overflow in Oracle Net Services for Oracle Database Server Hyperlink: http://otn.oracle.com/deploy/security/pdf/2003alert54.pdf External Source: Security Focus Name: bid 7453 Hyperlink: http://www.securityfocus.com/bid/7453 External Source: NTBUGTRAQ Name: m=105163376015735& Hyperlink: http://marc.theaimsgroup.com/?l=ntbugtraq& External Source: CIAC Name: N-085 Hyperlink: http://www.ciac.org/ciac/bulletins/n-085.shtml External Source: XF Name: oracle-database-link-bo(11885) Hyperlink: http://xforce.iss.net/xforce/xfdb/11885 External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: NTBUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=ntbugtraq& ### Vulnerable Software and Vendor Oracle8i (Oracle) Oracle9i Release 2 (Oracle) Oracle7 (Oracle) Oracle8 (Oracle) Oracle9i (Oracle) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0222