Buffer Overflows Patched in Oracle 9i Database

British security research firm NGSSoftware has discovered multiple
security vulnerabilities in Oracle’s database server software. The firm is warning that the most serious flaw could lead to system takeover.

The vulnerabilities affect the Oracle9i Database (both enterprise and standard editions) and can be exploited by malicious database users to compromise the system and gain escalated privileges, the research firm warned.

Security alerting service Secunia rates the flaws as “moderately
critical.”

Oracle 9i Database users are urged to upgrade to version 9.2.0.4 and apply Patch 3 from the company’s Metalink site.

The database management software, used by large scale enterprises to store and access data across numerous platforms, contains a security hole due to boundary errors in two functions and could cause buffer overflows . NGSSoftware said the buffer overflow could be caused by supplying an overly long character string.

Two separate vulnerabilities are being caused due to boundary errors in the “FROM_TZ” function and in the “TIME_ZONE” parameter, NGSSoftware said.

“Successful exploitation of the vulnerabilities may allow a malicious, unprivileged database user to execute arbitrary code with either SYSTEM or ORACLE privileges.”