Info

Disclosure

Jun 27, 2001

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

A buffer overflow exists in Oracle. The TNS Listener fails to validate passed to the STATUS, PING, SERVICES, TRC_FILE, SAVE_CONFIG and RELOAD commands resulting in a stack overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability.

Products

Oracle Corporation

Database Server 8i

8.1.7

References

CVE ID: 2001-0499 (see also: NVD)
Bugtraq ID: 2941
CERT VU: 620495
ISS X-Force ID: 6758
Metasploit ID: 9427
Generic Exploit URL: http://immunitysec.com
Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=103833206805744&w=2
Vendor Specific Advisory URL: http://otn.oracle.com/deploy/security/pdf/nai_net8_bof.pdf

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/9427