Oracle Internet Directory Format String Vulnerabilities

Bugtraq ID:	3048
Class:	Input Validation Error
CVE:	CVE-2001-0974
Remote:	Yes
Local:	No
Published:	Jul 16 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	The vulnerabilities were discovered using the PROTOS project's LDAPv3 test suite. Test results were published in a CERT Security Advisory on July 16, 2001.
Vulnerable:	Oracle Internet Directory 3.0.1 .1.0 Oracle Internet Directory 2.1.1 .0.0
Not Vulnerable:	Oracle Internet Directory 3.0.1 .1.0 Oracle Internet Directory 2.1.1 .3.0

Oracle Internet Directory Format String Vulnerabilities

Solution:
Vendor-supplied updates that rectify this issue are available:

1) OID release 3.0.1.0.0 (shipping with Oracle9i) on all Unix platforms
2) OID release 3.0.1.0.0 (shipping with Oracle9i) on Windows
3) OID release 2.1.1.3.0 (shipping with Oracle8i) on Solaris

Download the patchset for your platform from Oracle's Worldwide Support web site, Metalink, http://metalink.oracle.com.

The patch number for OID release 2.1.1.3.0 is 1888945
The patch number for OID release 3.0.1.0.0 is 1888998

Oracle Internet Directory Format String Vulnerabilities

References:

• Oracle Internet Directory Buffer Overflow Vulnerability (PDF) (Oracle)
  
• Oracle Technology Network - Security (Oracle)
  
• PROTOS Test-Suite: c06-ldapv3 (PROTOS Project)