Oracle Database Network Foundation Heap Memory Corruption Vulnerability

Bugtraq ID:	35677
Class:	Unknown
CVE:	CVE-2009-1963
Remote:	Yes
Local:	No
Published:	Jul 14 2009 12:00AM
Updated:	Jul 24 2009 10:36PM
Credit:	Dennis Yurichev
Vulnerable:	Oracle Oracle11g Standard Edition 11.1 6 Oracle Oracle11g Enterprise Edition 11.1 6
Not Vulnerable:

Oracle Database Network Foundation Heap Memory Corruption Vulnerability

Oracle Database is prone to a remote heap memory-corruption vulnerability in Network Foundation.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

Successfully exploiting this issue will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Oracle Database Network Foundation Heap Memory Corruption Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/tcp_fwd_0.zip

Oracle Database Network Foundation Heap Memory Corruption Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for details.

Oracle Database Network Foundation Heap Memory Corruption Vulnerability

References:

• CVE-2009-1963 PoC (CPUjul2009) (Dennis Yurichev)
  
• Oracle Homepage (Oracle)
  
• Oracle CPUjul2009 (Dennis Yurichev )
  
• Oracle Critical Patch Update Advisory - July 2009 (Oracle)