GEN:SID 1:2611
Message ORACLE LINK metadata buffer overflow attempt
Summary This event is generated when an attempt is made to exploit a known
vulnerability in a Oracle database implementation.
Impact Serious. Execution of arbitrary code may be possible. A Denial of
Service (DoS) condition may also be caused.
Detailed Information An attacker can create a database link and supply it an overly
long string to the "USING" parameter of the "CREATE DATABASE LINK"
command. This long value is stored for later use. When subsequently
accessed via the link, a buffer overflow can occur.

If you are running Oracle on a Windows server, make sure that the
variable $ORACLE_PORTS is set to a value of "any".
Affected Systems Oracle 9i and earlier
Attack Scenarios An attacker can create a database link and supply it an overly long
"USING" value.  The result could permit the attacker to gain escalated
privileges and run code of their choosing.
Ease of Attack Simple.
Corrective Action Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.
Additional References CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0222

Bugtraq
http://www.securityfocus.com/bid/7453

Other:
http://archives.neohapsis.com/archives/bugtraq/2003-04/0360.html
Rule References bugtraq: 7453
cve: 2003-0222
url: archives.neohapsis.com/archives/bugtraq/2003-04/0360.html