CVE-2004-1363 — Incorrect Calculation of Buffer Size in Oracle Application Server

CWE-131 — Incorrect Calculation of Buffer SizeCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
27.7%
top 3.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Application ServerOracle Database ServerOracle E-business Suite+3 more
Timeline
PublishedAug 4
Latest updateApr 29

Description

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶NVDoracle/database_server7 versions+6
▶NVDoracle/e-business_suite9 versions+8
▶NVDoracle/application_server11 versions+10

Patches

Patch: www.ngssoftware.com ↗Patch: www.oracle.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v25x-3wqw-87r9: Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are ex↗2022-04-29
▶
CVEList
CVE-2004-1363: Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are ex↗2005-01-19
▶
CVE-2004-1363 — Incorrect Calculation of Buffer Size | cvebase