A vulnerability has been reported in Oracle Database, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure when processing the OWNER and NAME arguments to create an SQL query. This can be exploited to cause a buffer overflow by passing overly long OWNER and NAME arguments to the affected procedure.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in version 10g Release 2 with all Critical Patch Updates as of February 2007. Other versions may also be affected.

Solution
A fix is reportedly scheduled for a future Critical Patch Update.

Provided and/or discovered by
Discovered by an anonymous researcher and reported via iDefense Labs.

Original Advisory
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=622

Deep Links
Links available in Customer Area