Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1 8.1.7.4, allows remote authorized users to execute arbitrary code via a long second argument.

The remote Oracle Database, according to its version number, is vulnerable to several flaws, ranging from information disclosure about the remote host to code execution.

The remote host appears to be running a vulnerable version of Oracle Database Server. It is reported that Oracle Database Server version 8.1.7, 9.0.1.4, 9.0.1.5, 9.0.4, 9.2.0.4, 9.2.0.5 and 10.1.0.2 are prone to multiple vulnerabilities including buffer overflow issues, PL/SQL injection, trigger abuse, character set conversion bugs and denial of service issues. An attacker may exploit these vulnerabilities to deny service to legitimate users or to execute arbitrary code on the remote server.

The remote Oracle Database, according to its version number, contains a remote command execution vulnerability that may allow an attacker who can execute SQL statements with certain privileges to execute arbitrary commands on the remote host.

ID	Name	Product	Family	Type	Severity
16209	Oracle Database Multiple Vulnerabilities (January 2005 CPU)	Nessus	Databases	Remote	high
2277	Oracle Security Alert #68	Nessus Network Monitor	Database		high
14641	Oracle Database Multiple Remote Vulnerabilities (Mar 2005)	Nessus	Databases	Remote	high

Detections

Analytics

CVE-2004-0638

critical

Tenable Plugins

high

high

high