CVE-2003-0894

Vulnerability

Buffer overflow in the oracle and oracleO command-line client programs shipped with Oracle 9i Database versions 9.0.x and 9.2.x prior to 9.2.0.4 [1]. The overflow occurs when an overly long string is supplied as the first command-line argument (argv[1]) [1]. Affected platforms include all UNIX and Linux systems supported by Oracle; Oracle 8i is not vulnerable [1].

Exploitation

An attacker must have local access to the system where Oracle is installed [1]. By providing an excessively long argument to the target program, the attacker triggers a stack-based buffer overflow that overwrites sensitive memory locations. Publicly available exploit scripts exist for this vulnerability [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the oracle system user and membership in the dba group [1]. This enables the attacker to perform any action that the database administrator can perform, and may allow escalation to additional system privileges depending on system configuration [1].

Mitigation

Oracle released a patch via Oracle Security Alert #59 [1]. The fixed version is 9.2.0.4; there is no indication that 9.0.x will receive a patch. Systems at 9.2.0.4 or later are not affected. If patching is not immediately possible, restrict local access to the system to trusted users only, as the vulnerability requires local command-line interaction [1].