CVE-2002-1264

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-11-12 · updated 2026-06-16

Description

Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.

Affected products

Oracle9I: 9.0, 9.0.1, 9.0.1.2, 9.0.1.3, 9.0.2, release_2_9.2.1 (+1)

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0060.html
http://marc.info/?l=bugtraq&m=103643298712284&w=2
http://technet.oracle.com/deploy/security/pdf/2002alert46rev1.pdf
http://www.iss.net/security_center/static/10524.php
http://www.osvdb.org/4013
http://www.securityfocus.com/bid/6085
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0060.html
http://marc.info/?l=bugtraq&m=103643298712284&w=2
http://technet.oracle.com/deploy/security/pdf/2002alert46rev1.pdf
http://www.iss.net/security_center/static/10524.php
http://www.osvdb.org/4013
http://www.securityfocus.com/bid/6085

Get alerted when CVE-2002-1264 or the next vulnerability affects your stack