Users login

Create an account »


Users login

Home » Hacking News » Oracle TNS Listener Buffer Overflow

Oracle TNS Listener Buffer Overflow

by Nikola Strahija on June 12th, 2002 Systems: Windows and VM running all versions of Oracle 9i Database Severity: High Risk Category: Remote Buffer Overrun Vulnerability Vendor URL: Author: David Litchfield ([email protected]) Advisory URL: Date: 12th June 2002 Advisory number: #NISR12062002A (VNA reference : )

The Oracle Net Listener contains a remotely exploitable buffer overrun
vulnerability that can allow an attacker to gain complete control of a
machine running the Oracle 9i Database.

The Listener 'listens' on TCP port 1521 for client request to use the
database. On receiving a request the client is passed off to an instance of
the database. The request, packaged in a valid TNS packet is of the form


By supplying an overly long SERVICE_NAME parameter, when forming an error
message to be written to the log file, a saved return address on the stack
is overwritten thus gaining control over the processes execution. Any code
supplied by the attacker will run, by default, in the context of the Local
SYSTEM account on Windows platforms and as such is a high risk
vulnerability. Because the overflow occurs before the error message is
actually written to the log file it may be difficult to detect if an attack
has occured. Customers are advised to patch this as soon as is possible.

Fix Information
NGSSoftware alerted Oracle to this problem on the 13th of May and Oracle
have now released patches which are available from the Metalink site. The
patch number is 2367681.

A check for this vulnerability has been added to Typhon II, NGSSoftware's
vulnerability assessment scanner, of which, more information is available
from the NGSSite,

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »