Description
Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
References
- oracle-multiple-function-bo(15060) vdb-entry
- VU#399806 third-party-advisory
- 3840 vdb-entry
- O-093 third-party-advisory government-resource
- 10805 third-party-advisory
- VU#819126 third-party-advisory
- 3838 vdb-entry
- VU#240174 third-party-advisory
- 20040205 Oracle Database 9ir2 Interval Conversion Functions Buffer Overflow mailing-list
- 9587 vdb-entry
- 3839 vdb-entry
- VU#846582 third-party-advisory
- 3837 vdb-entry
- http://www.nextgenss.com/advisories/ora_numtodsinterval.txt
- http://www.nextgenss.com/advisories/ora_from_tz.txt
- http://www.nextgenss.com/advisories/ora_numtoyminterval.txt
- http://www.nextgenss.com/advisories/ora_time_zone.txt