Signature Detail

TNS: Oracle Database InterMedia Denial of Service

This signature detects attempts to exploit a known vulnerability in the Oracle Database Server's InterMedia system. This issue is caused by insufficient sanitization of user-supplied data in SQL statements. An attacker with limited privileges can exploit this vulnerability to create a denial-of-service condition on a vulnerable Oracle Database Server.

Extended Description

There is a denial of service vulnerability in Oracle Database Server. This issue is a result of a failure in the application to properly sanitize user-supplied input. This issue affects the Intermedia component and requires SQL (Oracle Net) access. A successful attack can compromise the availability of a vulnerable server. Oracle has released a Critical Patch Update to address this issue. It should be noted that this issue was previously reported in BID 13139 (Oracle Multiple Vulnerabilities); it has been assigned its own BID.

Affected Products

• Oracle Oracle10g Enterprise Edition 10.1.0 .0.2
• Oracle Oracle10g Enterprise Edition 9.0.4 .0
• Oracle Oracle10g Personal Edition 10.1.0 .0.2
• Oracle Oracle10g Personal Edition 9.0.4 .0
• Oracle Oracle10g Standard Edition 10.1.0 .0.2
• Oracle Oracle10g Standard Edition 9.0.4 .0
• Oracle Oracle9i Enterprise Edition 9.0.0 .2.4
• Oracle Oracle9i Enterprise Edition 9.2.0 .0
• Oracle Oracle9i Enterprise Edition 9.2.0 .0.1
• Oracle Oracle9i Enterprise Edition 9.2.0 .0.3
• Oracle Oracle9i Enterprise Edition 9.2.0.2
• Oracle Oracle9i Personal Edition 9.0.0 .2.4
• Oracle Oracle9i Personal Edition 9.2.0
• Oracle Oracle9i Personal Edition 9.2.0 .0.1
• Oracle Oracle9i Personal Edition 9.2.0 .0.2
• Oracle Oracle9i Personal Edition 9.2.0 .0.3
• Oracle Oracle9i Personal Edition 9.2.0 .0.5
• Oracle Oracle9i Standard Edition 9.0.0 .2.4
• Oracle Oracle9i Standard Edition 9.2.0
• Oracle Oracle9i Standard Edition 9.2.0 .0.1
• Oracle Oracle9i Standard Edition 9.2.0 .0.2
• Oracle Oracle9i Standard Edition 9.2.0 .0.3
• Oracle Oracle9i Standard Edition 9.2.0 .0.5

References

• BugTraq: 13239
• URL: http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
• URL: http://www.appsecinc.com/resources/alerts/oracle/2005-01.html