{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Oracle9i Database Standard Edition v9.2.0.3.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle9i Database Enterprise Edition v9.2.0.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne faille de type d\u00e9bordement de m\u00e9moire pr\u00e9sente sur la variable\nchar_expr dans les deux fonctions de conversion NUMTOYMINTERVAL et\nNUMTODSINTERVAL permet \u00e0 un utilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du\ncode arbitraire sur syst\u00e8me.\n\nDeux autres d\u00e9bordements de m\u00e9moire sont pr\u00e9sents sur les param\u00e8tres TZD\n(Time Zone Difference) de la fonction FROM_TZ et TIME_ZONE.\n\n## Solution\n\nMettre \u00e0 jour Oracle9i Database avec la version Oracle9i Database\nRelease 2, version 9.2.0.3 ou la version 9.2.0.4 en appliquant le patch\n3 (cf site Metlalink Oracle, section documentation).\n",
  "cves": [],
  "initial_release_date": "2004-02-10T00:00:00",
  "last_revision_date": "2004-02-10T00:00:00",
  "links": [
    {
      "title": "NGSSoftware : Oracle NUMTOYMINTERVAL Remote System Overflow    :",
      "url": "http://www.nextgenss.com/advisories/ora_numtoyminterval.txt"
    },
    {
      "title": "NGSSoftware : Oracle FROM_TZ Remote System Overrun :",
      "url": "http://www.nextgenss.com/advisories/ora_from_tz.txt"
    },
    {
      "title": "NGSSoftware : Oracle TIME_ZONE Remote System Overrun :",
      "url": "http://www.nextgenss.com/advisories/ora_time_zone.txt"
    },
    {
      "title": "NGSSoftware : Oracle NUMTODSINTERVAL Remote System Overflow    :",
      "url": "http://www.nextgenss.com/advisories/ora_numtodsinterval.txt"
    },
    {
      "title": "Site Metalink d\u0027Oracle :",
      "url": "http://metalink.oracle.com"
    }
  ],
  "reference": "CERTA-2004-AVI-030",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-02-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans Oracle9i Database permettent \u00e0\nun utilisateur local de r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges (les\nprivil\u00e8ges System pour Windows ou Oracle pour Unix).\n",
  "title": "Vuln\u00e9rabilit\u00e9s sur Oracle9i Database",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 NGSSoftware",
      "url": null
    }
  ]
}