CVE-2004-1363
Estado: ModificadaCrítica (9.8)—
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 9.10%
- Percentil entre todas las CVEs puntuadas: 95
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (7)
CWE
- CWE-131
Referencias
- http://marc.info/?l=bugtraq&m=110382345829397&w=2
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
- http://www.kb.cert.org/vuls/id/316206
- http://www.ngssoftware.com/advisories/oracle23122004.txt
- http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
- http://www.securityfocus.com/bid/10871
- http://www.us-cert.gov/cas/techalerts/TA04-245A.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18659
- http://marc.info/?l=bugtraq&m=110382345829397&w=2
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
- http://www.kb.cert.org/vuls/id/316206
- http://www.ngssoftware.com/advisories/oracle23122004.txt
- http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
- http://www.securityfocus.com/bid/10871
- http://www.us-cert.gov/cas/techalerts/TA04-245A.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18659
JSON original (NVD)
Mostrar
{
"id": "CVE-2004-1363",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": true,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2004-08-04T04:00:00.000",
"references": [
{
"url": "http://marc.info/?l=bugtraq&m=110382345829397&w=2",
"tags": [
"Mailing List"
],
"source": "cve@mitre.org"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1",
"tags": [
"Broken Link"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.kb.cert.org/vuls/id/316206",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.ngssoftware.com/advisories/oracle23122004.txt",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/10871",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA04-245A.html",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18659",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://marc.info/?l=bugtraq&m=110382345829397&w=2",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.kb.cert.org/vuls/id/316206",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ngssoftware.com/advisories/oracle23122004.txt",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/10871",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA04-245A.html",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18659",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-131"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed."
}
],
"lastModified": "2026-06-16T22:07:33.280",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:application_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD38E99A-864A-4E99-B6A5-12AACDA822E3"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFAE1E8A-644B-42FD-B149-89AD420BD7A7"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8075E330-5819-4105-9BB7-4DCC3C0EAEF9"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB346764-EDF2-4BE1-A273-C2CE9A173CFB"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E59B89D9-AAF9-40CB-931C-EB4958491B99"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C64888FB-133F-4930-8368-1BD2A4FB11A6"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87DEB7BD-FB71-4C22-A0FF-89923B263DC2"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAAD1A33-4333-4AFB-8D49-1274AE345BA9"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "852BF209-3C6F-403B-920D-50C46D37515B"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "335143DB-4538-49F4-BAFB-C47802318667"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6A3E2D8-617C-4740-B662-F8884CE26BF1"
},
{
"criteria": "cpe:2.3:a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4FFBB096-523E-4634-ADC4-6CFB03F9577B"
},
{
"criteria": "cpe:2.3:a:oracle:collaboration_suite:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F72FA3A-068D-4DC8-84DF-A86FDA7CAE1A"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:8.1.7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B559C62F-88A7-42D3-9629-9F5CAD43F8B6"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:9.0.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2109201B-89F7-4FF2-BFD1-2B220E3146FD"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:9.0.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6C67572-800C-4214-AD12-E9017A9A5BAA"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:9.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E108197C-DCA8-4624-9FEF-621BFB299662"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:9.2.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4C63EC8-73D7-46AE-81E7-04DF212BC8B5"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:9.2.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47CC3066-82BA-41AB-B6C8-D2E7D7AE7D6F"
},
{
"criteria": "cpe:2.3:a:oracle:database_server:10.1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "553BAC35-0A37-40C2-A150-F34D59D097F4"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBD7B7B5-4C37-4EC7-8B1D-66C1E5043E11"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9E237E5-9E1A-4F20-9A3D-E3418E3B1329"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F57A5AE0-90B5-410E-8878-BD514C3B7946"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA7EAC35-E890-444A-B070-C91382F2E242"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69568B66-122B-4946-B630-2960DAA1885E"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB6E1838-B4DA-4F62-8713-9E8D7E79CDF5"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C3E4A5C-8D0F-4105-8618-26586BEDE84B"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D07FEA4F-B1C7-4250-81FD-AC1289769348"
},
{
"criteria": "cpe:2.3:a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78408427-3FFB-45C4-82EF-C8D636B3A718"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager:9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3595689-13AE-4349-8684-D73D33D4A9FC"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager:9.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53F57A30-BE27-4F93-B8E4-B0956007F625"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_database_control:10.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F074FCED-60D9-4B07-8A6F-85A89C8CFC33"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_grid_control:10.1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "016AFE8B-049D-4BA9-9270-E18DFDFDC61F"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}