CVE-2001-0941

Vulnerability

Buffer overflow in the dbsnmp executable (part of Oracle Enterprise Manager Intelligent Agent) in Oracle versions 8.0.6 through 9.0.1. The overflow occurs when the ORACLE_HOME environment variable exceeds approximately 750 bytes. The dbsnmp binary is installed with the setuid bit set, making it run with elevated privileges. [1]

Exploitation

A local attacker can set the ORACLE_HOME environment variable to a value longer than 750 bytes before executing dbsnmp. The overflow corrupts memory, allowing the attacker to control execution flow. No authentication beyond local shell access is required. The attacker must have the ability to set environment variables and execute the binary. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the Oracle operating system account (typically oracle). This results in local privilege escalation from an unprivileged user to the Oracle account, potentially leading to full compromise of the Oracle installation and associated data. [1]

Mitigation

Oracle released a patch available from Oracle Metalink (now Oracle Support). Alternatively, administrators can remove the setuid bit from dbsnmp using chmod -s dbsnmp if the Intelligent Agent is not required. The vulnerability affects Oracle versions 8.0.6 through 9.0.1 on Unix/Linux platforms only. [1]