What’s Vulnerable › Vulnerabilities

CVE-2004-1363

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2004-08-04 · updated 2026-06-16
• Weakness: CWE-131

Description

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

Affected products

• Oracle Application Server: 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2, 9.0.2.3 (+5)
• Oracle Collaboration Suite: all versions
• Oracle Database: 8.1.7.4, 9.0.1.4, 9.0.1.5, 9.0.4, 9.2.0.4, 9.2.0.5 (+1)
• Oracle E-Business Suite: 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6 (+3)
• Oracle Corporation Enterprise Manager for Fusion Middleware: 9, 9.0.1
• Oracle Enterprise Manager Database Control: 10.1.2
• Oracle Enterprise Manager Grid Control: 10.1.0.2

References

• http://marc.info/?l=bugtraq&m=110382345829397&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
• http://www.kb.cert.org/vuls/id/316206
• http://www.ngssoftware.com/advisories/oracle23122004.txt
• http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
• http://www.securityfocus.com/bid/10871
• http://www.us-cert.gov/cas/techalerts/TA04-245A.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18659
• http://marc.info/?l=bugtraq&m=110382345829397&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
• http://www.kb.cert.org/vuls/id/316206
• http://www.ngssoftware.com/advisories/oracle23122004.txt

Get alerted when CVE-2004-1363 or the next vulnerability affects your stack