Oracle Database string conversion buffer overflow

Added: 08/23/2006
BID: 10871
OSVDB: 9890

Background

Oracle Database is a relational database product for multiple platforms.

Problem

The string conversion function in Oracle Database is affected by a buffer overflow vulnerability. A remote attacker could execute arbitrary commands by sending a long argument to the to_char function with the systimestamp option.

Resolution

Apply the patch referenced in Oracle Alert 68.

References

http://www.us-cert.gov/cas/techalerts/TA04-245A.html
http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0041.html

Limitations

Exploit works on Oracle9i Database 9.2.0.1.

Exploit requires the sqlplus utility, which can be downloaded from http://www.oracle.com/technology/software/tech/oci/instantclient/index.html. Download the Instant Client Basic or Basic Lite and SQL*Plus packages and unzip them in the /home or /usr/local directory.

Exploit requires a valid database login and password.

Platforms

Windows

Back to exploit index