British security research firm NGSSoftware has discovered multiple security vulnerabilities in Oracle's database server software. The firm is warning that the most serious flaw could lead to system takeover.
The vulnerabilities affect the Oracle9i Database (both enterprise and standard editions) and can be exploited by malicious database users to compromise the system and gain escalated privileges, the research firm warned.
Security alerting service Secunia rates the flaws as "moderately critical."https://o1.qnsr.com/log/p.gif?;n=203;c=204660766;s=9477;x=7936;f=201812281312070;u=j;z=TIMESTAMP;a=20392931;e=iOracle 9i Database users are urged to upgrade to version 184.108.40.206 and apply Patch 3 from the company's Metalink site.
The database management software, used by large scale enterprises to store and access data across numerous platforms, contains a security hole due to boundary errors in two functions and could cause buffer overflows
Two separate vulnerabilities are being caused due to boundary errors in the "FROM_TZ" function and in the "TIME_ZONE" parameter, NGSSoftware said.
"Successful exploitation of the vulnerabilities may allow a malicious, unprivileged database user to execute arbitrary code with either SYSTEM or ORACLE privileges."