CVE-2002-0559

3 documents3 sources
Severity
7.5HIGH
EPSS
38.7%
top 2.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Oracle Application ServerOracle Application Server WEB CacheOracle Oracle8i+1 more
Timeline
PublishedJul 3
Latest updateApr 30

Description

Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long HTTP request to the plsql module, (3) a long password in the HTTP Authorization, (4) a long Access Descriptor (DAD) password in the addadd form, or (5) a long cache directory name.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶NVDoracle/application4 versions+3
▶NVDoracle/oracle8i8.1.7, 8.1.7.1+1
▶NVDoracle/oracle9i9.0, 9.0.1+1

Patches

Patch: online.securityfocus.com ↗Patch: www.cert.org ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xwhc-m79g-6vgf: Buffer overflows in PL/SQL module 3↗2022-04-30
▶
CVEList
CVE-2002-0559: Buffer overflows in PL/SQL module 3↗2002-06-11
▶
CVE-2002-0559 (HIGH CVSS 7.5) | Buffer overflows in PL/SQL module 3 | cvebase.io