{"api_version":"1","generated_at":"2026-07-23T03:24:34+00:00","cve":"CVE-2002-0857","urls":{"html":"https://cve.report/CVE-2002-0857","api":"https://cve.report/api/cve/CVE-2002-0857.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0857","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0857"},"summary":{"title":"CVE-2002-0857","description":"Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-09-05 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.kb.cert.org/vuls/id/301059","name":"http://www.kb.cert.org/vuls/id/301059","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"CERT/CC Vulnerability Note VU#301059","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf","name":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Technical Resources | Oracle","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt","name":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"-1","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=102933735716634&w=2","name":"http://marc.info/?l=bugtraq&m=102933735716634&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'Oracle Listener Control Format String Vulnerabilities (#NISR14082002)' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1005037","name":"http://securitytracker.com/id?1005037","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle 9i Database Input Validation Bugs in the Oracle Net Listener Lets Remote Authenticated Users Crash the Listener, Denying Service to Database Users - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/5460","name":"http://www.securityfocus.com/bid/5460","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Net Listener Format String Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0857","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0857","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"857","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"7.3.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"857","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"857","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"9.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"857","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"oracle8i","cpe6":"8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T03:03:49.257Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf"},{"name":"VU#301059","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/301059"},{"name":"1005037","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1005037"},{"name":"5460","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/5460"},{"name":"20020814 Oracle Listener Control Format String Vulnerabilities (#NISR14082002)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=102933735716634&w=2"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-08-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-10-17T13:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf"},{"name":"VU#301059","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/301059"},{"name":"1005037","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1005037"},{"name":"5460","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/5460"},{"name":"20020814 Oracle Listener Control Format String Vulnerabilities (#NISR14082002)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=102933735716634&w=2"},{"tags":["x_refsource_MISC"],"url":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0857","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf","refsource":"CONFIRM","url":"http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf"},{"name":"VU#301059","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/301059"},{"name":"1005037","refsource":"SECTRACK","url":"http://securitytracker.com/id?1005037"},{"name":"5460","refsource":"BID","url":"http://www.securityfocus.com/bid/5460"},{"name":"20020814 Oracle Listener Control Format String Vulnerabilities (#NISR14082002)","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=102933735716634&w=2"},{"name":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt","refsource":"MISC","url":"http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0857","datePublished":"2002-08-20T04:00:00.000Z","dateReserved":"2002-08-15T00:00:00.000Z","dateUpdated":"2024-08-08T03:03:49.257Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-09-05 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:7.3.4:*:*:*:*:*:*:*","matchCriteriaId":"AE07BAF7-3A9A-426B-9536-72EAB8984A4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7AC3C795-3914-4941-9244-D4FB9C12C7F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:9.2:*:*:*:*:*:*:*","matchCriteriaId":"3D159781-4109-4A9B-A46B-241021FED68E"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:oracle8i:8.1:*:*:*:*:*:*:*","matchCriteriaId":"44943278-DF79-4C58-AA98-B3FEA6CB8F21"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"857","Ordinal":"1","Title":"CVE-2002-0857","CVE":"CVE-2002-0857","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"857","Ordinal":"1","NoteData":"Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.","Type":"Description","Title":"CVE-2002-0857"},{"CveYear":"2002","CveId":"857","Ordinal":"2","NoteData":"2002-08-20","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"857","Ordinal":"3","NoteData":"2016-10-17","Type":"Other","Title":"Modified"}]}}}