CVE-2002-0857

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=102933735716634&w=2
http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdfPatch, Vendor Advisory
http://securitytracker.com/id?1005037
http://www.kb.cert.org/vuls/id/301059US Government Resource
http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt
http://www.securityfocus.com/bid/5460
http://marc.info/?l=bugtraq&m=102933735716634&w=2
http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdfPatch, Vendor Advisory
http://securitytracker.com/id?1005037
http://www.kb.cert.org/vuls/id/301059US Government Resource
http://www.ngssoftware.com/advisories/ora-lsnrfmtstr.txt
http://www.securityfocus.com/bid/5460

Timeline

Published: Sep 5, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-08587.5catsnmp in Oracle 9i and 8i is installed with a dbsnmp user with a default dbsnmp password, which allows attackers to perform restricted dat CVE-2002-08597.5Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary c CVE-2002-08605.0The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbi CVE-2002-08617.5Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even CVE-2002-08626.8The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft produc CVE-2002-08635.0Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext sessi CVE-2002-08645.0The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote attackers to cause a denial of service (crash) when Remote CVE-2002-08657.5A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.o CVE-2002-08667.5Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and CVE-2002-08675.0Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet E CVE-2002-08697.5Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote att CVE-2002-08707.5The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, whi