Description
Unspecified vulnerability in Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors related to the Log Miner component and sys.dbms_log_mnr privileges, aka DB04. NOTE: Oracle has not disputed a reliable researcher claim that this is a buffer overflow in the ADD_LOGFILE procedure for the SYS.DBMS_LOGMNR package that allows code execution.
References
- 20070129 Re: Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL mailing-list
- 23794 third-party-advisory
- 22083 vdb-entry
- http://www.appsecinc.com/resources/alerts/oracle/2007-01.shtml
- http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
- 32910 vdb-entry
- TA07-017A third-party-advisory
- 20070124 Oracle Buffer Overflow in DBMS_LOGMNR.ADD_LOGFILE mailing-list
- oracle-cpu-jan2007(31541) vdb-entry
- 1017522 vdb-entry