During the login process an Oracle user with no more than “create session” privileges can execute commands in the context of the special database user SYS. This of course grants any user the highest administrative privileges possible.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/43277/OracleDBMS-TNS.txt
Source: https://packetstormsecurity.com/files/43277/OracleDBMS-TNS.txt.html