Oracle/Linux

[andsome]

The following could interest Linux/Oracle users.

"The struggle itself towards the heights

is enough to fill a man's heart."

Albert Camus (1913-60); French-Algerian philosopher.

- Buffer overflow in Oracle -

Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com)

Madrid, October 20, 2003 - SecurityTracker has reported, at

http://www.securitytracker.com/alerts/2003/Oct/1007956.html, a buffer

overflow vulnerability in the Orcale database system, which could allow a

local user to run code and increase privileges on the affected system.

This problem lies in the fact that a local user could pass a large input

string to the database to trigger a buffer overflow and overwrite the EIP

register to execute arbitrary code. A demo exploit of the vulnerability has

already been published.

According to reports, the 'oracle' and 'oracleO' binaries are affected. As

the binaries are reportedly configured with set user id (setuid) 'oracle'

user privileges, the arbitrary code will run with the privileges of the

'oracle' user. The report indicates that version 9.2.0.4.0 is vulnerable on

Linux and AIX, although other versions could also be affected.

NOTE: The address above may not show up on your screen as a single line.

This would prevent you from using the link to access the web page. If this

happens, just use the 'cut' and 'paste' options to join the pieces of the

URL.

------------------------------------------------------------

The 5 viruses most frequently detected by Panda ActiveScan, Panda Software's

free online scanner: 1)Parite.B; 2)Blaster; 3)Istbar.H; 4)Gibe.C;

5)Bugbear.B.

------------------------------------------------------------

To unsubscribe from Oxygen3 24h-365d, please visit:

http://www.pandasoftware.com/unsubscribe.asp

To contact with Panda Software, please visit:

http://www.pandasoftware.com/about/contact/

------------------------------------------------------------