CVEvulnerability

CVE-2004-1363

9.8 CRITICAL Published 2004-08-04 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-08-04
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-131

Description

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

Affected configurations

• oracle application server • oracle application server 9.0.2 • oracle application server 9.0.2.0.0 • oracle application server 9.0.2.0.1 • oracle application server 9.0.2.1 • oracle application server 9.0.2.2 • oracle application server 9.0.2.3 • oracle application server 9.0.3 • oracle application server 9.0.3.1 • oracle application server 9.0.4 • oracle application server 9.0.4.0 • oracle application server 9.0.4.1 • oracle collaboration suite • oracle database server 8.1.7.4 • oracle database server 9.0.1.4 • oracle database server 9.0.1.5 • oracle database server 9.0.4 • oracle database server 9.2.0.4 • oracle database server 9.2.0.5 • oracle database server 10.1.0.2 • oracle e-business suite 11.5.1 • oracle e-business suite 11.5.2 • oracle e-business suite 11.5.3 • oracle e-business suite 11.5.4 • oracle e-business suite 11.5.5 • oracle e-business suite 11.5.6 • oracle e-business suite 11.5.7 • oracle e-business suite 11.5.8 • oracle e-business suite 11.5.9 • oracle enterprise manager 9 • oracle enterprise manager 9.0.1 • oracle enterprise manager database control 10.1.2 • oracle enterprise manager grid control 10.1.0.2

Related

Weakness · CWE (1)

  • CWE-131 Incorrect Calculation of Buffer Size weakness

Referenced by CWE · observed example (2)

  • CWE-131 Incorrect Calculation of Buffer Size weakness
  • CWE-682 Incorrect Calculation weakness

References