Vulnerability in Oracle Application Server
CVE-2004-1363
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.091 (95.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.091 · newest: 0.091 · change: 0.000
Affected products
- Oracle Application Server — versions 9.0.2, 9.0.2.0.0, 9.0.2.0.1
- Oracle Collaboration Suite
- Oracle Database Server — versions 8.1.7.4, 9.0.1.4, 9.0.1.5
- Oracle E-Business Suite — versions 11.5.1, 11.5.2, 11.5.3
- Oracle Enterprise Manager — versions 9, 9.0.1
- Oracle Enterprise Manager Database Control — versions 10.1.2
- Oracle Enterprise Manager Grid Control — versions 10.1.0.2
Weakness classification (CWE)
References
- exchange.xforce.ibmcloud.com/vulnerabilities/18659 (VDB Entry, Third Party Advisory, vdb-entry)
- www.ngssoftware.com/advisories/oracle23122004.txt (Patch, Broken Link, Vendor Advisory)
- marc.info/ (mailing-list, Mailing List)
- www.kb.cert.org/vuls/id/316206 (US Government Resource, Third Party Advisory, third-party-advisory)
- www.us-cert.gov/cas/techalerts/TA04-245A.html (US Government Resource, Patch, Third Party Advisory, Broken Link, third-party-advisory)
- www.securityfocus.com/bid/10871 (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf (Patch, Broken Link, Vendor Advisory)
- sunsolve.sun.com/search/document.do (vendor-advisory, Broken Link)
Frequently asked questions
- What is CVE-2004-1363?
- CVE-2004-1363 is a critical-severity vulnerability in Oracle Application Server, classified under Incorrect Calculation of Buffer Size. CVSS score: 9.8/10. Published 2004-08-04.
- How severe is CVE-2004-1363?
- Critical severity. CVSS v3 base score is 9.8 out of 10.