Vulnerability Note VU#840666
Oracle9i Database contains remotely exploitable buffer overflow in "TO_TIMESTAMP_TZ" function
A remotely exploitable buffer overflow vulnerability exists in Oracle9i Database.
A remote attacker can overwrite a return address on the Oracle process stack, resulting in the ability to execute arbitrary code with the privileges of the vulnerable process. This process typically runs as "Oracle" on Linux and UNIX hosts and as "Local System" on Windows systems.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Oracle Corporation||Affected||-||17 Feb 2003|
CVSS Metrics (Learn More)
This vulnerability was discovered by Mark Litchfield (firstname.lastname@example.org) of Next Generation Security Software Ltd. The CERT/CC thanks both Next Generation Security Software Ltd and Oracle for providing information upon which this document is based.
This document was written by Ian A Finlay.
- CVE IDs: Unknown
- Date Public: 11 Feb 2003
- Date First Published: 18 Feb 2003
- Date Last Updated: 19 Feb 2003
- Severity Metric: 27.00
- Document Revision: 5
If you have feedback, comments, or additional information about this vulnerability, please send us email.