CVE-2003-1208

Name: CVE-2003-1208
Creator: NVD / NIST
Published: 2004-12-03T05:00:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 13.19%

Last modified Jun 16, 2026

CVE-2003-1208 is a vulnerability of currently unknown severity. Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.. EPSS estimates a 13.19% chance of exploitation in the next 30 days.

Description

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.

Metrics

EPSS Probability

13.19%

95.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Oracle	Oracle9i	enterprise_9.0.1
Oracle	Oracle9i	enterprise_9.2.0
Oracle	Oracle9i	enterprise_9.2.0.1
Oracle	Oracle9i	enterprise_9.2.0.2
Oracle	Oracle9i	personal_9.0.1
Oracle	Oracle9i	personal_9.2
Oracle	Oracle9i	personal_9.2.0.1
Oracle	Oracle9i	personal_9.2.0.2
Oracle	Oracle9i	standard_9.0
Oracle	Oracle9i	standard_9.0.1
Oracle	Oracle9i	standard_9.0.1.2
Oracle	Oracle9i	standard_9.0.1.3
Oracle	Oracle9i	standard_9.0.1.4
Oracle	Oracle9i	standard_9.0.2
Oracle	Oracle9i	standard_9.2
Oracle	Oracle9i	standard_9.2.0.1
Oracle	Oracle9i	standard_9.2.0.2

References

http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.htmlExploit, Vendor Advisory
http://secunia.com/advisories/10805Exploit, Patch
http://www.ciac.org/ciac/bulletins/o-093.shtmlPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/240174Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/399806Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/819126Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/846582Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/advisories/ora_from_tz.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_numtodsinterval.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_numtoyminterval.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_time_zone.txtExploit
http://www.osvdb.org/3837Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3838Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3839Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3840Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/9587Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15060
http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.htmlExploit, Vendor Advisory
http://secunia.com/advisories/10805Exploit, Patch
http://www.ciac.org/ciac/bulletins/o-093.shtmlPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/240174Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/399806Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/819126Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/846582Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/advisories/ora_from_tz.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_numtodsinterval.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_numtoyminterval.txtExploit, Patch
http://www.nextgenss.com/advisories/ora_time_zone.txtExploit
http://www.osvdb.org/3837Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3838Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3839Exploit, Patch, Vendor Advisory
http://www.osvdb.org/3840Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/9587Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15060

Timeline

Published: Dec 3, 2004
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2003-1208?

How severe is CVE-2003-1208?

Severity scoring for CVE-2003-1208 is pending analysis. The EPSS model estimates a 13.19% probability of exploitation in the next 30 days.

How do I fix CVE-2003-1208?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2003-1208?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST