Oracle Internet Directory Buffer Overflow Vulnerabilities

Bugtraq ID:	3047
Class:	Boundary Condition Error
CVE:	CVE-2001-0975
Remote:	Yes
Local:	No
Published:	Jul 16 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	The vulnerabilities were discovered using the PROTOS project's LDAPv3 test suite. Test results were published in a CERT Security Advisory on July 16, 2001.
Vulnerable:	Oracle Internet Directory 3.0.1 .1.0 Oracle Internet Directory 2.1.1 .0.0
Not Vulnerable:	Oracle Internet Directory 3.0.1 .1.0 Oracle Internet Directory 2.1.1 .3.0

Oracle Internet Directory Buffer Overflow Vulnerabilities

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle Internet Directory Buffer Overflow Vulnerabilities

Solution:
Vendor-supplied updates that rectify this issue are available:

1) OID release 3.0.1.0.0 (shipping with Oracle9i) on all Unix platforms
2) OID release 3.0.1.0.0 (shipping with Oracle9i) on Windows
3) OID release 2.1.1.3.0 (shipping with Oracle8i) on Solaris

Download the patchset for your platform from Oracle's Worldwide Support web site, Metalink, http://metalink.oracle.com.

The patch number for OID release 2.1.1.3.0 is 1888945
The patch number for OID release 3.0.1.0.0 is 1888998