Oracle Database Buffer Overflow Vulnerabilities in Procedure DBMS_DRS.GET_PROPERTY (DB03)
19 Jul. 2007
Summary
Oracle Database Server provides the DBMS_DRS package that includes procedures used in Oracle Data Guard. This package contains the function GET_PROPERTY which is vulnerable to buffer overflow attacks.
Vulnerable Systems:
* Oracle Database Server versions 9i, 9iR2, 10gR1 and 10gR2
Impact:
Any Oracle database user with EXECUTE privilege on the package SYS.DBMS_DRS can exploit this vulnerability. Exploitation of this vulnerability allows an attacker to execute arbitrary code. It can also be exploited to cause DOS (Denial of service) killing Oracle server process.
Vendor Status:
Vendor was contacted and a patch was released.
Workaround:
Restrict access to the SYS.DBMS_DRS package.
