Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
BID:8375
Info
Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
| Bugtraq ID: | 8375 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0727 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 31 2003 12:00AM |
| Updated: | Nov 26 2009 07:15PM |
| Credit: | Discovery of these vulnerabilities has been credited to David Litchfield([email protected]). |
| Vulnerable: |
Oracle Oracle9i Standard Edition 9.2 .0.1 Oracle Oracle9i Personal Edition 9.2 .0.1 Oracle Oracle9i Enterprise Edition 9.2 .0.1 |
| Not Vulnerable: |
Oracle Oracle9i Standard Edition 9.0 .2.4 Oracle Oracle9i Personal Edition 9.0 .2.4 Oracle Oracle9i Enterprise Edition 9.0 .2.4 |
Discussion
Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
In a paper titled "Variations in exploit methods between Linux and Windows" presented at Blackhat 2003, David Litchfield has illustrated multiple vulnerabilities in the Oracle 9i XML Database (XDB).
Successful exploits may allow remote attackers to run arbitrary code in the security context of the vulnerable service.
In a paper titled "Variations in exploit methods between Linux and Windows" presented at Blackhat 2003, David Litchfield has illustrated multiple vulnerabilities in the Oracle 9i XML Database (XDB).
Successful exploits may allow remote attackers to run arbitrary code in the security context of the vulnerable service.
Exploit / POC
Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Working exploits are available in the referenced paper by David Litchfield.
The following exploits have been made available for the Metasploit framework:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Working exploits are available in the referenced paper by David Litchfield.
The following exploits have been made available for the Metasploit framework:
Solution / Fix
Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
Solution:
Oracle has released patches to address these issues. See the referenced advisory (Oracle Security Alert 58) for details on obtaining and applying patches using the Oracle metalink site tool.
Solution:
Oracle has released patches to address these issues. See the referenced advisory (Oracle Security Alert 58) for details on obtaining and applying patches using the Oracle metalink site tool.
References
Multiple Oracle XDB FTP / HTTP Services Buffer Overflow Vulnerabilities
References:
References:
- Oracle Homepage (Oracle)
- Oracle Security Alert 58 (Oracle)
- OracleDB XDB FTP UNLOCK overflow exploit (CORE Security)
- OracleDB XDB HTTP password overflow exploit (CORE Security)
- Variations in Exploit methods between Linux and Windows (David Litchfield ([email protected]))