|
|
| |
Credit:
The information has been provided by Esteban Mart nez Fay .
|
| |
Vulnerable Systems:
* Oracle Database Server version 9iR1 and 9iR2
The plan name parameter used in ALTER SYSTEM SET RESOURCE_MANAGER_PLAN statement and in SYS.DBMS_RESOURCE_MANAGER.SWITCH_PLAN procedure is vulnerable to buffer overflow attacks. When passing an overly long plan name string a buffer can be overflowed.
Workaround
Restrict ALTER SYSTEM privilege.
Patch Availability:
Apply Oracle Critical Patch Update July 2009 available here:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2009.html
CVE Information:
CVE-2009-0979
Disclosure Timeline:
8/15/2007 - Vendor Notification
07/14/2009 - Fix
08/07/2009 - Public Disclosure
--------------------------------------------------------------------------------------------------------------------------------
Find out how to use a SQL injection vulnerability scanner.
|
|
|
