2611.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
2611

--
Summary:
This event is generated when an attempt is made to exploit a known vulnerability in a Oracle database implementation.

--
Impact:
Serious. Execution of arbitrary code may be possible. A Denial of Service (DoS) condition may also be caused.

--
Detailed Information:

An attacker can create a database link and supply it an overly long string to the "USING" parameter of the "CREATE DATABASE LINK" command. This long value is stored for later use. When subsequently accessed via the link, a buffer overflow can occur.

If you are running Oracle on a Windows server, make sure that the variable $ORACLE_PORTS is set to a value of "any".

--
Affected Systems:
Oracle 9i and earlier

--
Attack Scenarios:
An attacker can create a database link and supply it an overly long "USING" value.  The result could permit the attacker to gain escalated privileges and run code of their choosing.

--
Ease of Attack:
Simple.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.

--
Contributors:
Sourcefire Vulnerability Research Team
Matt Watchinski <[e-mail]>
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>
Judy Novak <[e-mail]>

--
Additional References:

CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0222

--