rapid7/metasploit-framework — pull request #1718 by dominicwang (2013-04-10 08:08:37+00:00)
Title: CVE-2003-0095 Fixed

Since I no longer have access to the original Git account, I've made a
new pull request (This one)

To jvazquez-r7:

- The module is now msftidy compliant
- The line 34, 35 URL references have been removed
- Replaced failwith to return Exploit::CheckCode::Unknown
- Replaced original connect with connect(true, {'RPORT' => redir_port})
- Replaced "OOPS!" with "OOPS! Perhaps the service hasn't started
completely!"
- tns_login has been randomized
- Removed the unnessary debug function sleep()
- Removed handler
- Updated and added ROP support for 9i Release 2
- Updated contact information

Q: Aren't versions lower than 9.2.0.1.0 vulnerable? According to the
description 9i, 8i, 8.1.7, and 8.0.6 are vulnerable.
A: The exploit authentication scheme is different in 8, will upload a
separate module later.

Q: As for "Is it the usual to not find DEP on system where this version
is installed? Sice it's a vuln from 2003 it could be... but I'm not sure
atm, so just asking. If the usual is to find DEP on this target I guess
the correct would be to use DEP bypass on the Automatic target. just
asking :)"
A: Oracle 9.2.0.1.0 and below support Microsoft Windows 2000, XP, and
2003

Q: Can it be randomized? Would be nice to avoid easy exploit detection
A: The host string is a requirement to trigger the bof (Since it was
included in workgroup info), might try portion randomization if needed.

Q: Two times get_once? just asking :)
A: Yes sir you got that right! ;)

P.S. Sorry for the late update, was on vacation last week. :)