CVE-2003-1208

CRITICAL 10.0CVE-2003-1208 · Published 03/12/2004 · updated 16/06/2026

Package	Affected versions	Patched versions
oracle9i oracle	`= enterprise_9.0.1= enterprise_9.2.0= enterprise_9.2.0.1= enterprise_9.2.0.2= personal_9.0.1= personal_9.2= personal_9.2.0.1= personal_9.2.0.2= standard_9.0= standard_9.0.1= standard_9.0.1.2= standard_9.0.1.3= standard_9.0.1.4= standard_9.0.2= standard_9.2= standard_9.2.0.1= standard_9.2.0.2`	No fix yet

Description

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.

References

archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.html · Exploit
secunia.com/advisories/10805 · Exploit
ciac.org/ciac/bulletins/o-093.shtml · Patch
kb.cert.org/vuls/id/240174 · Patch
kb.cert.org/vuls/id/399806 · Patch
kb.cert.org/vuls/id/819126 · Patch
kb.cert.org/vuls/id/846582 · Patch
nextgenss.com/advisories/ora_from_tz.txt · Exploit
nextgenss.com/advisories/ora_numtodsinterval.txt · Exploit
nextgenss.com/advisories/ora_numtoyminterval.txt · Exploit
nextgenss.com/advisories/ora_time_zone.txt · Exploit
osvdb.org/3837 · Exploit
osvdb.org/3838 · Exploit
osvdb.org/3839 · Exploit
osvdb.org/3840 · Exploit
securityfocus.com/bid/9587 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/15060

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free