Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

The remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities :

  - CVE-2000-0169: Remote command execution in the web     listener component.

  - CVE-2000-1235: Information disclosure in the port     listener component and modplsql.

  - CVE-2000-1236: SQL injection in mod_sql.

  - CVE-2001-0326: Information disclosure in the Java     Virtual Machine.

  - CVE-2001-0419: Buffer overflow in ndwfn4.so.

  - CVE-2001-0591: Directory traversal.

  - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.

  - CVE-2001-1217: Directory traversal vulnerability in the     PL/SQL Apache module.

  - CVE-2001-1371: Improper access control in the SOAP     service.

  - CVE-2001-1372: Information disclosure.

  - CVE-2002-0386: Denial of service through the     administration module for Oracle Web Cache.

  - CVE-2002-0559: Buffer overflows in the PL/SQL module.

  - CVE-2002-0560: Information disclosure in the PL/SQL     module.

  - CVE-2002-0561: Authentication bypass in the PL/SQL     Gateway web administration interface.

  - CVE-2002-0562: Information disclosure through     globals.jsa.

  - CVE-2002-0563: Improper access control on several     services.

  - CVE-2002-0564: Authentication bypass in the PL/SQL     module.

  - CVE-2002-0565: Information disclosure through JSP files     in the _pages directory.

  - CVE-2002-0566: Denial of service in the PL/SQL module.

  - CVE-2002-0568: Improper access control on XSQLConfig.xml     and soapConfig.xml.

  - CVE-2002-0569: Authentication bypass through     XSQLServlet.

  - CVE-2002-0655: Denial of service in OpenSSL.

  - CVE-2002-0656: Buffer overflows in OpenSSL.

  - CVE-2002-0659: Denial of service in OpenSSL.

  - CVE-2002-0840: Cross-site scripting in the default error     page of Apache.

  - CVE-2002-0842: Format string vulnerability in mod_dav.

  - CVE-2002-0843: Buffer overflows in ApacheBench.

  - CVE-2002-0947: Buffer overflow in rwcgi60.

  - CVE-2002-1089: Information disclosure in rwcgi60.

  - CVE-2002-1630: Improper access control on sendmail.jsp.

  - CVE-2002-1631: SQL injection in query.xsql.

  - CVE-2002-1632: Information disclosure through several     JSP pages.

  - CVE-2002-1635: Information disclosure in Apache.

  - CVE-2002-1636: Cross-site scripting in the htp PL/SQL     package.

  - CVE-2002-1637: Default credentials in multiple     components.

  - CVE-2002-1858: Information disclosure through the     WEB-INF directory.

  - CVE-2002-2153: Format string vulnerability in the     administrative pages of the PL/SQL module.

  - CVE-2002-2345: Credential leakage in the web cache     administrator interface.

  - CVE-2002-2347: Cross-site scripting in several JSP     pages.

  - CVE-2004-1362: Authentication bypass in the PL/SQL     module.

  - CVE-2004-1363: Buffer overflow in extproc.

  - CVE-2004-1364: Directory traversal in extproc.

  - CVE-2004-1365: Command execution in extproc.

  - CVE-2004-1366: Improper access control on     emoms.properties.

  - CVE-2004-1367: Credential leakage in Database Server.

  - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.

  - CVE-2004-1369: Denial of service in TNS Listener.

  - CVE-2004-1370: Multiple SQL injection vulnerabilities in     PL/SQL.

  - CVE-2004-1371: Stack-based buffer overflow.

  - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.

  - CVE-2004-1774: Buffer overflow in the MD2 package.

  - CVE-2004-1877: Phishing vulnerability in Single Sign-On     component.

  - CVE-2004-2134: Weak cryptography for passwords in the     toplink mapping workBench.

  - CVE-2004-2244: Denial of service in the XML parser.

  - CVE-2005-1383: Authentication bypass in HTTP Server.

  - CVE-2005-1495: Detection bypass.

  - CVE-2005-1496: Privilege escalation in the     DBMS_Scheduler.

  - CVE-2005-2093: Web cache poisoning.

  - CVE-2005-3204: Cross-site scripting.

  - CVE-2005-3445: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2005-3446: Unspecified vulnerability in Internet     Directory.

  - CVE-2005-3447: Unspecified vulnerability in Single     Sign-On.

  - CVE-2005-3448: Unspecified vulnerability in the OC4J     module.

  - CVE-2005-3449: Multiple unspecified vulnerabilities in     multiple components.

  - CVE-2005-3450: Unspecified vulnerability in HTTP Server.

  - CVE-2005-3451: Unspecified vulnerability in     SQL*ReportWriter.

  - CVE-2005-3452: Unspecified vulnerability in Web Cache.

  - CVE-2005-3453: Multiple unspecified vulnerabilities in     Web Cache.

  - CVE-2006-0273: Unspecified vulnerability in the Portal     component.

  - CVE-2006-0274: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0275: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0282: Unspecified vulnerability.

  - CVE-2006-0283: Unspecified vulnerability.

  - CVE-2006-0284: Multiple unspecified vulnerabilities.

  - CVE-2006-0285: Unspecified vulnerability in the Java Net     component.

  - CVE-2006-0286: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0287: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0288: Multiple unspecified vulnerabilities in     the Oracle Reports Developer component.

  - CVE-2006-0289: Multiple unspecified vulnerabilities.

  - CVE-2006-0290: Unspecified vulnerability in the Oracle     Workflow Cartridge component.

  - CVE-2006-0291: Multiple unspecified vulnerabilities in     the Oracle Workflow Cartridge component.

  - CVE-2006-0435: Unspecified vulnerability in Oracle     PL/SQL.

  - CVE-2006-0552: Unspecified vulnerability in the Net     Listener component.

  - CVE-2006-0586: Multiple SQL injection vulnerabilities.

  - CVE-2006-1884: Unspecified vulnerability in the Oracle     Thesaurus Management System component.

  - CVE-2006-3706: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3707: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3708: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3709: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3710: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3711: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3712: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3713: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3714: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5353: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5354: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5355: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5356: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5357: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5358: Unspecified vulnerability in the Oracle     Forms component.

  - CVE-2006-5359: Multiple unspecified vulnerabilities in     Oracle Reports Developer component.

  - CVE-2006-5360: Unspecified vulnerability in Oracle Forms     component.

  - CVE-2006-5361: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5362: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5363: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5364: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5365: Unspecified vulnerability in Oracle     Forms.

  - CVE-2006-5366: Multiple unspecified vulnerabilities.

  - CVE-2007-0222: Directory traversal vulnerability in     EmChartBean.

  - CVE-2007-0275: Cross-site scripting vulnerability in     Oracle Reports Web Cartridge (RWCGI60).

  - CVE-2007-0280: Buffer overflow in Oracle Notification     Service.

  - CVE-2007-0281: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2007-0282: Unspecified vulnerability in OPMN02.

  - CVE-2007-0283: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0284: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-0285: Unspecified vulnerability in Oracle     Reports Developer.

  - CVE-2007-0286: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0287: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0288: Unspecified vulnerability in Oracle     Internet Directory.

  - CVE-2007-0289: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-1359: Improper access control in mod_security.

  - CVE-2007-1609: Cross-site scripting vulnerability in     servlet/Spy in Dynamic Monitoring Services (DMS).

  - CVE-2007-2119: Cross-site scripting vulnerability in the     Administration Front End for Oracle Enterprise (Ultra)     Search.

  - CVE-2007-2120: Denial of service in the Oracle     Discoverer servlet.

  - CVE-2007-2121: Unspecified vulnerability in the COREid     Access component.

  - CVE-2007-2122: Unspecified vulnerability in the Wireless     component.

  - CVE-2007-2123: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2124: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2130: Unspecified vulnerability in Workflow     Cartridge.

  - CVE-2007-3553: Cross-site scripting vulnerability in     Rapid Install Web Server.

  - CVE-2007-3854: Multiple unspecified vulnerabilities in     the Advanced Queuing component and the Spatial     component.

  - CVE-2007-3859: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-3861: Unspecified vulnerability in Oracle     Jdeveloper.

  - CVE-2007-3862: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-3863: Unspecified vulnerability in Oracle     JDeveloper.

  - CVE-2007-5516: Unspecified vulnerability in the Oracle     Process Mgmt & Notification component.

  - CVE-2007-5517: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5518: Unspecified vulnerability in HTTP Server.

  - CVE-2007-5519: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5520: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5521: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-5522: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5523: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5524: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5525: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5526: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5531: Unspecified vulnerability in Oracle Help     for Web.

  - CVE-2008-0340: Multiple unspecified vulnerabilities in     the Advanced Queuing component and Spatial component.

  - CVE-2008-0343: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0344: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0345: Unspecified vulnerability in the Core     RDBMS component.

  - CVE-2008-0346: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-0347: Unspecified vulnerability in the Oracle     Ultra Search component.

  - CVE-2008-0348: Multiple unspecified vulnerabilities in     the PeopleTools component.

  - CVE-2008-0349: Unspecified vulnerability in the     PeopleTools component.

  - CVE-2008-1812: Unspecified vulnerability in the Oracle     Enterprise Manager component.

  - CVE-2008-1814: Unspecified vulnerability in the Oracle     Secure Enterprise Search or Ultrasearch component.

  - CVE-2008-1823: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-1824: Unspecified vulnerability in the Oracle     Dynamic Monitoring Service component.

  - CVE-2008-1825: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2583: Unspecified vulnerability in the sample     Discussion Forum Portlet for the Oracle Portal     component.

  - CVE-2008-2588: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-2589: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2593: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2594: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2595: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2008-2609: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2612: Unspecified vulnerability in the Hyperion     BI Plus component.

  - CVE-2008-2614: Unspecified vulnerability in HTTP Server.

  - CVE-2008-2619: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2008-2623: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-3975: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3977: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3986: Unspecified vulnerability in the Oracle     Discoverer Administrator component.

  - CVE-2008-3987: Unspecified vulnerability in the Oracle     Discoverer Desktop component.

  - CVE-2008-4014: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2008-4017: Unspecified vulnerability in the OC4J     component.

  - CVE-2008-5438: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-7233: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2009-0217: Signature spoofing vulnerability in     multiple components.

  - CVE-2009-0989: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0990: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0994: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1008: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1009: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1010: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1011: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1017: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1976: Unspecified vulnerability in HTTP Server.

  - CVE-2009-1990: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-1999: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-3407: Unspecified vulnerability in the Portal     component.

  - CVE-2009-3412: Unspecified vulnerability in the Unzip     component.

  - CVE-2010-0066: Unspecified vulnerability in the Access     Manager Identity Server component.

  - CVE-2010-0067: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2010-0070: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-0789: Unspecified vulnerability in HTTP Server.

  - CVE-2011-0795: Unspecified vulnerability in Single     Sign-On.

  - CVE-2011-0884: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2011-2237: Unspecified vulnerability in the Oracle     Web Services Manager component.

  - CVE-2011-2314: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-3523: Unspecified vulnerability in the Oracle     Web Services Manager component.

Sun Management Center 3.5.1: Solaris 9 Oracle Patch.
Date this patch was last updated by Sun : Jun/02/05

Sun Management Center 3.5.1: Solaris 8 Oracle Patch.
Date this patch was last updated by Sun : Jun/02/05

The remote Oracle Database, according to its version number, is vulnerable to several flaws, ranging from information disclosure about the remote host to code execution.

The remote host appears to be running a vulnerable version of Oracle Database Server. It is reported that Oracle Database Server version 8.1.7, 9.0.1.4, 9.0.1.5, 9.0.4, 9.2.0.4, 9.2.0.5 and 10.1.0.2 are prone to multiple vulnerabilities including buffer overflow issues, PL/SQL injection, trigger abuse, character set conversion bugs and denial of service issues. An attacker may exploit these vulnerabilities to deny service to legitimate users or to execute arbitrary code on the remote server.

The remote Oracle Database, according to its version number, contains a remote command execution vulnerability that may allow an attacker who can execute SQL statements with certain privileges to execute arbitrary commands on the remote host.

ID	Name	Product	Family	Severity
57619	Oracle Application Server Multiple Vulnerabilities	Nessus	Web Servers	critical
23549	Solaris 9 (sparc) : 118829-04	Nessus	Solaris Local Security Checks	high
23409	Solaris 8 (sparc) : 118828-04	Nessus	Solaris Local Security Checks	high
16209	Oracle Database Multiple Vulnerabilities (January 2005 CPU)	Nessus	Databases	high
2277	Oracle Security Alert #68	Nessus Network Monitor	Database	high
14641	Oracle Database Multiple Remote Vulnerabilities (Mar 2005)	Nessus	Databases	high

Detections

Analytics

CVE-2004-1363

critical

Tenable Plugins

critical

high

high

high

high

high