CVE-2004-1363
Critical
Description
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Oracle Application Server
PublishedAug 4, 2004
First seenAug 4, 2004
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle application_server | No range specified, 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2, 9.0.2.3, 9.0.3, 9.0.3.1, 9.0.4, 9.0.4.0, 9.0.4.1 | — |
| oracle collaboration_suite | No range specified | — |
| oracle database_server | 8.1.7.4, 9.0.1.4, 9.0.1.5, 9.0.4, 9.2.0.4, 9.2.0.5, 10.1.0.2 | — |
| oracle e-business_suite | 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9 | — |
| oracle enterprise_manager | 9, 9.0.1 | — |
| oracle enterprise_manager_database_control | 10.1.2 | — |
| oracle enterprise_manager_grid_control | 10.1.0.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.