CVE-2004-0385 - Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0

CVE-2004-0385

Summary

Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities."

References

Vulnerable Configurations

cpe:2.3:a:oracle:application_server_web_cache:9.0.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server_web_cache:9.0.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11i:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11i:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 11-07-2017 - 01:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	9868
bugtraq	20040316 new security alert #66 issued in Oracle web cache 20040408 Heap Overflow in Oracle 9iAS / 10g Application Server Web Cache
cert-vn	VU#413006
confirm	http://otn.oracle.com/deploy/security/pdf/2004alert66.pdf
misc	http://www.inaccessnetworks.com/ian/services/secadv01.txt
osvdb	4249
secunia	11118
vulnwatch	20040408 Heap Overflow in Oracle 9iAS / 10g Application Server Web Cache
xf	oracle-web-cache-vulnerabilities(15463)

Last major update

11-07-2017 - 01:30

Published

01-06-2004 - 04:00

Last modified

11-07-2017 - 01:30