CVE-2001-0941

Description

Buffer overflow in dbsnmp in Oracle 8.0.6 through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable.

Affected products

• oracle / database_server8.0.6 – 8.0.6
• oracle / database_server8.1.6 – 8.1.6
• oracle / database_server8.1.7 – 8.1.7
• oracle / database_server9.0.1 – 9.0.1

Exploits & proofs of concept

• exploit-dbOracle 8/9i - DBSNMP Oracle Home Environment Variable Buffer Overflowby Juan Manuel Pascual Escribá

References

• MISChttp://www.securityfocus.com/bid/3138
• VENDOR_ADVISORYhttp://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf
• MAILING_LISThttp://marc.info/?l=bugtraq&m=100716693806967&w=2
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/7643