Oracle Database Link Buffer Overflow

ReportedApril 30, 2003, by NGSSoftware

VERSIONSAFFECTED

OracleDatabase Link Buffer Overflow in Oracle9i Release 1 and 2; Oracle 8i,all releases; Oracle 8, all releases; and Oracle 7.3.x

DESCRIPTION

TheOracle database server contains a buffer-overflow condition. Toexploit the condition, a malicious user can provide a long parameterfor a connect string with the CREATE DATABASE LINK query.

DEMONSTRATION

Aquery must first be created:

CREATEDATABASE LINK ngss

CONNECTTO hr

IDENTIFIEDBY hr

USING'longstring'

Thenthe database must be selected, where the overflow is then triggeredupon selection:

select* from table@ngss

VENDORRESPONSE

Oraclehas released a patchto correct the problem.

CREDIT

Discoveredby NGSSoftware