Re: Oracle security alert #66 - new information available

Hi Norm,

hope you are well?

The exploit jmig has discovered is a heap overflow rather than a buffer overflow. What happens is that it is possible to corrupt heap memory that you do not own. In this way with a carefully crafted string you can write a pointer into a specific memory location that overwrites a function pointer address such as a pointer table for a DLL that has been loaded into memory dynamically. Then its possible to get the application to execute your code instead of the intended function.

I found a good paper that explains buffer overflows, heap overflows, pointer overflows, format string exploits etc. Its at http://www.covertsystems.org/archives/misc-papers/csr-exploitation.pdf

hth

kind regards

Pete

-- 
Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.