9.8

CVE-2004-1363

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Application Server Version 9.0.2
Oracle ≫ Application Server Version 9.0.2.0.0
Oracle ≫ Application Server Version 9.0.2.0.1
Oracle ≫ Application Server Version 9.0.2.1
Oracle ≫ Application Server Version 9.0.2.2
Oracle ≫ Application Server Version 9.0.2.3
Oracle ≫ Application Server Version 9.0.3
Oracle ≫ Application Server Version 9.0.3.1
Oracle ≫ Application Server Version 9.0.4
Oracle ≫ Application Server Version 9.0.4.0
Oracle ≫ Application Server Version 9.0.4.1
Oracle ≫ Collaboration Suite Version -
Oracle ≫ Database Server Version 8.1.7.4
Oracle ≫ Database Server Version 9.0.1.4
Oracle ≫ Database Server Version 9.0.1.5
Oracle ≫ Database Server Version 9.0.4
Oracle ≫ Database Server Version 9.2.0.4
Oracle ≫ Database Server Version 9.2.0.5
Oracle ≫ Database Server Version 10.1.0.2
Oracle ≫ E-business Suite Version 11.5.1
Oracle ≫ E-business Suite Version 11.5.2
Oracle ≫ E-business Suite Version 11.5.3
Oracle ≫ E-business Suite Version 11.5.4
Oracle ≫ E-business Suite Version 11.5.5
Oracle ≫ E-business Suite Version 11.5.6
Oracle ≫ E-business Suite Version 11.5.7
Oracle ≫ E-business Suite Version 11.5.8
Oracle ≫ E-business Suite Version 11.5.9
Oracle ≫ Enterprise Manager Version 9
Oracle ≫ Enterprise Manager Version 9.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.1% 0.946
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-131 Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
Broken Link
http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
Patch
Vendor Advisory
Broken Link
http://www.securityfocus.com/bid/10871
Patch
Third Party Advisory
Broken Link
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA04-245A.html
Patch
Third Party Advisory
US Government Resource
Broken Link
http://marc.info/?l=bugtraq&m=110382345829397&w=2
Mailing List
http://www.kb.cert.org/vuls/id/316206
Third Party Advisory
US Government Resource
http://www.ngssoftware.com/advisories/oracle23122004.txt
Patch
Vendor Advisory
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/18659
Third Party Advisory
VDB Entry