Command Execution Vulnerability in Oracle Database Product
CVE-2004-1365

Currently unrated

Key Information:

Vendor

Oracle
Status
Oracle10g
Oracle8i
Oracle9i
Collaboration Suite
Vendor
CVE Published:
4 August 2004

What is CVE-2004-1365?

The Extproc feature in Oracle Database versions 9i and 10g is vulnerable as it does not require authentication for loading libraries or executing functions. This weakness allows local users to execute arbitrary commands under the privileges of the Oracle user, potentially leading to escalated privileges and significant security breaches. With the absence of proper access controls in this mechanism, it poses a critical risk to database integrity and system security. Organizations using these affected versions should consider implementing immediate mitigations and upgrading to secure versions.

References

http://www.ngssoftware.com/advisories/oracle23122004C.txt
x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/18662
vdb-entryx_refsource_XF
http://marc.info/?l=bugtraq&m=110382471608835&w=2
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.