CVE:CVE-2004-1364
CNNVD:CNNVD-200408-009
Oracle Database是一款商业性质大型数据库系统。
Oracle 10g extproc存在目录遍历问题，远程攻击者可以利用这个漏洞绕过目录限制，访问其他库。
extproc验证'$ORACLE_HOME\bin'目录中的库，这主要是为了保证外部库不能被装载，但是存在一个目录遍历问题，可导致攻击者绕过目录限制，访问如libc和msvcrt.dll库，通过调用system()函数可执行任意OS命令。
solution:Upgrade oracle application_server to a higher version than *,9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.0.4,9.0.4.0,9.0.4.1,and avoid the version 9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.0.4,9.0.4.0,9.0.4.1; Upgrade oracle collaboration_suite to a higher version than release_1,and avoid the version release_1; Upgrade oracle e-business_suite to a higher version than 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9,and avoid the version 11.5.1,11.5.2,11.5.3,11.5.4,11.5.5,11.5.6,11.5.7,11.5.8,11.5.9; Upgrade oracle enterprise_manager to a higher version than 9,9.0.1,and avoid the version 9,9.0.1; Upgrade oracle enterprise_manager_database_control to a higher version than 10.1.2,and avoid the version 10.1.2; Upgrade oracle enterprise_manager_grid_control to a higher version than 10.1.0.2,and avoid the version 10.1.0.2; Upgrade oracle oracle10g to a higher version than enterprise_9.0.4_.0,enterprise_10.1.0.2,personal_9.0.4_.0,personal_10.1_.0.2,standard_9.0.4_.0,standard_10.1_.0.2,and avoid the version enterprise_9.0.4_.0,enterprise_10.1.0.2,personal_9.0.4_.0,personal_10.1_.0.2,standard_9.0.4_.0,standard_10.1_.0.2; Upgrade oracle oracle8i to a higher version than enterprise_8.0.5_.0.0,enterprise_8.0.6_.0.0,enterprise_8.0.6_.0.1,enterprise_8.1.5_.0.0,enterprise_8.1.5_.0.2,enterprise_8.1.5_.1.0,enterprise_8.1.6_.0.0,enterprise_8.1.6_.1.0,enterprise_8.1.7_.0.0,enterprise_8.1.7_.1.0,enterprise_8.1.7_.4,standard_8.0.6,standard_8.0.6_.3,standard_8.1.5,standard_8.1.6,standard_8.1.7,standard_8.1.7_.0.0,standard_8.1.7_.1,standard_8.1.7_.4,and avoid the version enterprise_8.0.5_.0.0,enterprise_8.0.6_.0.0,enterprise_8.0.6_.0.1,enterprise_8.1.5_.0.0,enterprise_8.1.5_.0.2,enterprise_8.1.5_.1.0,enterprise_8.1.6_.0.0,enterprise_8.1.6_.1.0,enterprise_8.1.7_.0.0,enterprise_8.1.7_.1.0,enterprise_8.1.7_.4,standard_8.0.6,standard_8.0.6_.3,standard_8.1.5,standard_8.1.6,standard_8.1.7,standard_8.1.7_.0.0,standard_8.1.7_.1,standard_8.1.7_.4; Upgrade oracle oracle9i to a higher version than client_9.2.0.1,client_9.2.0.2,enterprise_8.1.7,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,personal_8.1.7,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,standard_8.1.7,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.2,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5,and avoid the version client_9.2.0.1,client_9.2.0.2,enterprise_8.1.7,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,personal_8.1.7,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,standard_8.1.7,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.2,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5