CVE-2009-0991

published 2009-04-15

CVE-2009-0991: Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect…

Priority P3 35 medium 5 CVSS 2.0

AV N AC L Au N C N I N A P

EXPLOIT

Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-1970.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
oracle	database_10g	—	—
oracle	database_10g	—	—
oracle	database_11g	—	—
oracle	database_9i	—	—
oracle	database_9i	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 1521↗

process oranro11.dll↗

bytes↗

\x00\x68\x00\x00\x01\x00\x00\x00\x01\x3A\x01\x2C\x00\x00\x20\x00\x7F\xFF\xC6\x0E\x00\x00\x01\x00\x00\x2E\x00\x3A\x00\x00\x00\x00...\x28\x43\x4F\x4E\x4E\x45\x43\x54\x5F\x44\x41\x54\x41\x3D\x28\x43\x4F\x4D\x4D\x41\x4E\x44\x3D\x73\x65\x72\x76\x69\x63\x65\x5F\x72\x65\x67\x69\x73\x74\x65\x72\x5F\x4E\x53\x47\x52\x29\x29

• → The exploit sends a two-stage TNS packet sequence to TCP port 1521; the first packet contains the TNS CONNECT_DATA command 'service_register_NSGR' which triggers the vulnerable memcpy in ncrfintn() inside oranro11.dll, causing a DoS/trap in the Listener process. ↗
• → First-stage TNS packet begins with bytes 0x00 0x68 0x00 0x00 0x01 0x00 0x00 0x00 and contains the ASCII string CONNECT_DATA=(COMMAND=service_register_NSGR)); monitor TNS traffic on port 1521 for this pattern. ↗
• → Second-stage oversized TNS DATA packet (0x02DE bytes, starting with 0x02 0xde 0x00 0x00 0x06) is sent after the initial CONNECT response; its abnormal size and structure relative to a normal TNS handshake is a strong anomaly indicator. ↗
• → Crash occurs inside oranro11.dll in the ncrfintn() function via a malformed memcpy call; Oracle Listener process crash or unexpected restart on port 1521 should be treated as a potential exploitation attempt. ↗

• · PoC was confirmed only against Oracle RDBMS Win32 11.1.0.6.0 and Oracle RDBMS Win32 10.2.0.3 with latest CPU patches applied at time of discovery; behaviour on other platforms or patch levels may differ. ↗
• · CVE-2009-0991 is distinct from CVE-2009-1970; both affect the Oracle Listener component but are separate vulnerabilities. Detection rules should not conflate the two. ↗
• · The fix for CVE-2009-0991 was shipped in CPUapr2009; systems patched with that CPU or later are not vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.