A remote overflow exists in Oracle Database Server. The server fails to properly sanitize user input supplied to the first or second parameter of the SYSTIMESTAMP function resulting in a buffer overflow. With a specially crafted request, an attacker can cause the execution of arbitrary code or crash the server resulting in a loss of integrity or availability.
Classification
Location:
Remote/Network Access Required
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified,
Vendor Verified
Technical
A valid database account with any privileges is required to exploit this.
Solution
Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability:
appsecinc.com - Application Security, Inc.