Secunia

Amit Klein has identified a vulnerability in Oracle9i Database and Application Server, allowing malicious people to cause a Denial of Service.

The vulnerability is caused due to an error in the XML parser when parsing the DTD (Document Type Definition) part of XML documents.

This can be exploited on SOAP enabled servers by sending a specially crafted SOAP request, which causes a vulnerable SOAP server to consume all CPU resources for a longer period of time as well as large amounts of memory.

The following versions are affected:
Oracle9i Application Server Release 2, version 9.0.3.0 and 9.0.3.1
Oracle9i Application Server Release 2, version 9.0.2.1 and earlier
Oracle9i Application Server Release 1, version 1.0.2.2
Oracle9i Database Server Release 2, version 9.2.0.2
Oracle9i Database Server Release 1, version 9.0.1.4

Solution
Patches are available, see Metalink Document ID 259556.1:
Further details available in Customer Area

Provided and/or discovered by
Amit Klein, Sanctum Inc.

Original Advisory
http://otn.oracle.com/deploy/security/pdf/2004alert65.pdf

Deep Links
Links available in Customer Area