Buffer overflow in Oracle Database Server
CVE-2003-0222
Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.0 (High). Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.110 (95.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.110 · newest: 0.110 · change: 0.000
Affected products
- Oracle Database Server — versions 7.3.3, 7.3.4, 8.0.1
- Oracle Oracle8i — versions 8.0.6, 8.0.6.3, 8.0x
- Oracle Oracle9i — versions 9.0, 9.0.1, 9.0.1.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- marc.info/ (mailing-list)
- www.ciac.org/ciac/bulletins/n-085.shtml (government-resource, third-party-advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/11885 (vdb-entry)
- otn.oracle.com/deploy/security/pdf/2003alert54.pdf (Patch, Vendor Advisory)
- marc.info/ (mailing-list)
- www.securityfocus.com/bid/7453 (Patch, vdb-entry, Vendor Advisory)
Frequently asked questions
- What is CVE-2003-0222?
- CVE-2003-0222 is a vulnerability in Oracle Database Server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2003-05-12.
- Is CVE-2003-0222 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.