Oracle Applications FNDWRR CGI Remote Buffer Overflow Vulnerability

Bugtraq ID:	8269
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 24 2003 12:00AM
Updated:	Jul 24 2003 12:00AM
Credit:	Discovery is credited to Stephen Kost.
Vulnerable:	Oracle E-Business Suite 11i 11.8 Oracle E-Business Suite 11i 11.7 Oracle E-Business Suite 11i 11.6 Oracle E-Business Suite 11i 11.5 Oracle E-Business Suite 11i 11.4 Oracle E-Business Suite 11i 11.3 Oracle E-Business Suite 11i 11.2 Oracle E-Business Suite 11i 11.1 Oracle Applications 11.0 Oracle Applications 10.7
Not Vulnerable:

Oracle Applications FNDWRR CGI Remote Buffer Overflow Vulnerability

A problem in the handling of data by the Oracle Applications FNDWRR CGI program has been reported. This may result in a remote attacker gaining unauthorized access to a system using the vulnerable application.

Oracle Applications FNDWRR CGI Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle Applications FNDWRR CGI Remote Buffer Overflow Vulnerability

Solution:
Oracle has made fixes available. Administrators can download the patches at http://metalink.oracle.com.

The attached Oracle advisory also contains a release schedule for patches across all supported platforms.

Oracle Applications FNDWRR CGI Remote Buffer Overflow Vulnerability

References:

• Oracle E-Business Suite FNDWRR Buffer Overflow (Integrigy Security)
  
• Oracle Security Alert 56 (Oracle)