Description
Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login, as exploitable through client applications that perform their own authentication, as demonstrated using LOADPSP.
References
- CA-2003-05 third-party-advisory
- N-046 third-party-advisory government-resource
- 6849 vdb-entry
- 20030217 Oracle unauthenticated remote system compromise (#NISR16022003a) mailing-list
- http://otn.oracle.com/deploy/security/pdf/2003alert51.pdf
- oracle-username-bo(11328) vdb-entry
- 6319 vdb-entry
- VU#953746 third-party-advisory