CVE-2002-0857 — Use of Externally-Controlled Format String in Oracle Database Server

3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.5%
top 18.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Database ServerOracle Oracle8i
Timeline
PublishedSep 5
Latest updateApr 30

Description

Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDoracle/database_server7.3.4, 9.0, 9.2+2

Patches

Patch: otn.oracle.com ↗Patch: otn.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-264q-3fvj-9xhx: Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9↗2022-04-30
▶
CVEList
CVE-2002-0857: Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9↗2002-08-20
▶
CVE-2002-0857 — Oracle Database Server vulnerability | cvebase