iDefense Security Advisory 07.15.08 – Remote exploitation of a buffer overflow vulnerability in the DBMS_AQELM package in Oracle Corp.’s Oracle Database product allows attackers to execute arbitrary code with the privileges of the database user. This vulnerability exists due to improper input validation when handling a parameter passed to a procedure within the DBMS_AQELM package. Since the parameter is not properly validated, providing a long string can cause a buffer overflow to occur. This results in corruption of the database and could allow for the execution of arbitrary code as the database user. iDefense confirmed the existence of this vulnerability in Oracle Database version 10.2.0.3 and 11.1.0.6 with the October 2007 CPU applied. Previous versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/68229/07.15.08-2.txt
Source: https://packetstormsecurity.com/files/68229/iDEFENSE-Security-Advisory-2008-07-15.2.html