CVE-2010-0071: Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect…

PriorityP260critical10CVSS 2.0

AVNACLAuNCCICAC

EXPLOIT

EPSS

9.83%

95.0th percentile

Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—

Detection & IOCsextracted from sources · hover to see the quote

port1521↗

commandCONNECT_DATA=(COMMAND=service_register_NSGR))↗

processTNSLSNR.EXE↗

bytes↗

\x00\x68\x00\x00\x01\x00\x00\x00\x01\x3A\x01\x2C\x00\x00\x20\x00\x7F\xFF\xC6\x0E\x00\x00\x01\x00\x00\x2E\x00\x3A\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x28\x43\x4F\x4E\x4E\x45\x43\x54\x5F\x44\x41\x54\x41\x3D\x28\x43\x4F\x4D\x4D\x41\x4E\x44\x3D\x73\x65\x72\x76\x69\x63\x65\x5F\x72\x65\x67\x69\x73\x74\x65\x72\x5F\x4E\x53\x47\x52\x29\x29

→Detect exploit by monitoring for TNS CONNECT packets on port 1521 containing the ASCII string 'service_register_NSGR' in the CONNECT_DATA field, which is the malicious TNS command used to trigger the nsglvcrt() memory corruption. ↗
→Monitor TNSLSNR.EXE for abnormally large memory allocation attempts via malloc (e.g., 0x4222fc4 bytes) followed by a memcpy from a null/zero source, which indicates the nsglvcrt() heap corruption trigger. ↗
→The exploit is sent over the Oracle Net (TNS) protocol without requiring authentication; alert on unauthenticated TNS connections to port 1521 that send a second large data packet (>700 bytes) immediately after the initial CONNECT handshake response. ↗
→The first exploit packet begins with the byte sequence 00 68 00 00 01 00 00 00 01 3A 01 2C — monitor for this TNS packet header on port 1521 as a signature of the CVE-2010-0071 exploit attempt. ↗

·The exploit successfully crashes Oracle RDBMS versions 11.1.0.6.0, 11.1.0.7.0, 10.2.0.4 (win32) and 10.2.0.2 (Linux x86) but does NOT crash Oracle RDBMS 11.2 Linux x86, so detection rules should be scoped to affected versions only. ↗
·The vulnerability is fixed in CPUjan2010; systems with the January 2010 Critical Patch Update applied are not vulnerable and detections may generate false positives if patch status is not verified. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

GPL EXPLOIT ISAPI .ida access

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .ida access GPL EXPLOIT ISAPI .ida access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .ida access"; flow:established,to_server; http.uri; content:".ida"; nocase; endswith; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:2101242; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT ISAPI .ida attempt

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .ida attempt GPL EXPLOIT ISAPI .ida attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .ida attempt"; flow:established,to_server; http.uri; content:".ida?"; nocase; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-attack; sid:2101243; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT ISAPI .idq attempt

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .idq attempt GPL EXPLOIT ISAPI .idq attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq attempt"; flow:established,to_server; http.uri; content:".idq?"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:bugtraq,968; reference:cve,2000-0071; reference:cve,2000-0126; reference:nessus,10115; classtype:web-application-attack; sid:2101244; rev:18; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT ISAPI .idq access

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .idq access GPL EXPLOIT ISAPI .idq access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq access"; flow:established,to_server; http.uri; content:".idq"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:2101245; rev:14; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)