Vulnerability Description
Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Oracle9I | enterprise_9.0.1 |
References
- http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.htmlExploitVendor Advisory
- http://secunia.com/advisories/10805ExploitPatch
- http://www.ciac.org/ciac/bulletins/o-093.shtmlPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/240174PatchThird Party AdvisoryUS Government Resource
- http://www.kb.cert.org/vuls/id/399806PatchThird Party AdvisoryUS Government Resource
- http://www.kb.cert.org/vuls/id/819126PatchThird Party AdvisoryUS Government Resource
- http://www.kb.cert.org/vuls/id/846582PatchThird Party AdvisoryUS Government Resource
- http://www.nextgenss.com/advisories/ora_from_tz.txtExploitPatch
- http://www.nextgenss.com/advisories/ora_numtodsinterval.txtExploitPatch
- http://www.nextgenss.com/advisories/ora_numtoyminterval.txtExploitPatch
- http://www.nextgenss.com/advisories/ora_time_zone.txtExploit
- http://www.osvdb.org/3837ExploitPatchVendor Advisory
- http://www.osvdb.org/3838ExploitPatchVendor Advisory
- http://www.osvdb.org/3839ExploitPatchVendor Advisory
- http://www.osvdb.org/3840ExploitPatchVendor Advisory
FAQ
What is CVE-2003-1208?
CVE-2003-1208 is a vulnerability with a CVSS score of 10.0 (HIGH). Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the ...
How severe is CVE-2003-1208?
CVE-2003-1208 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-1208?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Oracle9I.