CVE-2004-0385

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities."

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-038610.0Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a lCVE-2004-03875.1Stack-based buffer overflow in the RT3 plugin, as used in RealPlayer 8, RealOne Player, RealOne Player 10 beta, and RealOne Player EnterprisCVE-2004-03882.1The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a symlink attack.CVE-2004-03897.5RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests thatCVE-2004-03907.5SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attacCVE-2004-039110.0Cisco Wireless LAN Solution Engine (WLSE) 2.0 through 2.5 and Hosting Solution Engine (HSE) 1.7 through 1.7.3 have a hardcoded username and CVE-2004-03925.0racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connections) via an IKE message withCVE-2004-039310.0Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format sCVE-2004-03942.1A "potential" buffer overflow exists in the panic() function in Linux 2.4.x, although it may not be exploitable due to the functionality of CVE-2004-03957.2The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows locaCVE-2004-03967.5Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers toCVE-2004-03977.5Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitra