{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eOracle9i Database Server Release 2 et  versions ant\u00e9rieures.\u003c/p\u003e",
  "content": "## Description\n\nOracle Database Server est le syst\u00e8me de gestion de base de donn\u00e9es\nd\u0027Oracle.\n\n  \n\nQuatre vuln\u00e9rabilit\u00e9s de type d\u00e9bordement de m\u00e9moire sont pr\u00e9sentes dans\nOracle Database Server. Ces vuln\u00e9rabilit\u00e9s sont mentionn\u00e9es dans les\nbulletins de s\u00e9curit\u00e9 suivants publi\u00e9s sur le site d\u0027Oracle :\n\n-   Buffer Overflow in DIRECTORY parameter of Oracle9i Database server ;\n-   Buffer Overflow in TZ_OFFSET function of Oracle9i Database server ;\n-   Buffer Overflow in TO_TIMESTAMP_TZ function of Oracle9i Database\n    server ;\n-   Buffer Overflow in ORACLE.EXE binary of Oracle9i Database server.\n\nL\u0027exploitation de ces vuln\u00e9rabilit\u00e9s permet \u00e0 un utilisateur mal\nintentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire sur le serveur h\u00e9bergeant la\nbase de donn\u00e9es.\n\nLa derni\u00e8re vuln\u00e9rabilit\u00e9 est exploitable par un utilisateur ne\nposs\u00e9dant pas d\u0027authentification sur le syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section\nDocumentation) pour obtenir les correctifs.\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #NISR16022003e \"ORACLE bfilename    function buffer overflow vulnerability\" de NGSSoftware :",
      "url": "http://www.nextgenss.com/advisories/ora-bfilebo.txt"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #NISR16022003b \"ORACLE TO_TIMESTAMP_TZ    remote system buffer overrun\" de NGSSoftware :",
      "url": "http://www.nextgenss.com/advisories/ora-tmstmpbo.txt"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #50 \"Buffer Overflow in    TO_TIMESTAMP_TZ function of Oracle9i Database server\" :",
      "url": "http://otn.oracle.com/deploy/security/pdf/2003alert50.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #49 \"Buffer Overflow in TZ_OFFSET    function of Oracle9i Database server\" :",
      "url": "http://otn.oracle.com/deploy/security/pdf/2003alert49.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #NISR16022003c \"ORACLE TZ_OFFSET    remote system buffer overrun\" de NGSSoftware :",
      "url": "http://www.nextgenss.com/advisories/ora-tzofstbo.txt"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 CA-2003-05 \"Multiple vulnerabilities in    Oracle servers\" du CERT/CC :",
      "url": "http://www.cert.org/advisories/CA-2003-05.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #51 \"Buffer Overflow in ORACLE.EXE    binary of Oracle9i Database server\" :",
      "url": "http://otn.oracle.com/deploy/security/pdf/2003alert51.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #48 \"Buffer Overflow in DIRECTORY    parameter of Oracle9i Database server\" :",
      "url": "http://otn.oracle.com/deploy/security/pdf/2003alert48.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #NISR16022003a \"ORACLE unauthenticated    remote system compromise\" de NGSSoftware :",
      "url": "http://www.nextgenss.com/advisories/ora-unauthrm.txt"
    }
  ],
  "reference": "CERTA-2003-AVI-023",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-02-17T00:00:00.000000"
    },
    {
      "description": "ajout condition d\u0027exploitation de la vuln\u00e9rabilit\u00e9 d\u00e9crite dans le bulletin de s\u00e9curit\u00e9 #51 d\u0027Oracle. Ajout documentation additionnelle.",
      "revision_date": "2003-02-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Quatre vuln\u00e9rabilit\u00e9s de type d\u00e9bordement de m\u00e9moire sont pr\u00e9sentes dans\nOracle Database Server.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Oracle Database Server",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 #49 d\u0027Oracle",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 #50 d\u0027Oracle",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 #51 d\u0027Oracle",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 #48 d\u0027Oracle",
      "url": null
    }
  ]
}