Unscored CVE-2001-0942 EUVD-2001-0925GHSA-r7g3-hhch-8xf3

dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE_HOME environment variable to find and execute the dbsnmp program, which allows local users…

Published Feb 2, 2002 · Updated Aug 8, 2024 · Assigned by mitre

Description

dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE_HOME environment variable to find and execute the dbsnmp program, which allows local users to execute arbitrary programs by pointing the ORACLE_HOME to an alternate directory that contains a malicious version of dbsnmp.

References

http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf
20011130 ASI Oracle Security Alert: Oracle Home Environment Variable Validation Vulnerability mailing-list
oracle-dbsnmp-home-validation(7645) vdb-entry
3137 vdb-entry