CVE-2000-0986: n/a vulnerability

CVE-2000-0986: Buffer overflow in Oracle 8.1.5 applications such as names, namesctl, onrsd, osslogin, tnslsnr, tnsping, tr...

Buffer overflow in Oracle 8.1.5 applications such as names, namesctl, onrsd, osslogin, tnslsnr, tnsping, trcasst, and trcroute possibly allow local users to gain privileges via a long ORACLE_HOME environmental variable.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 8, 2024, 05:37 UTC (UTC+00:00)

Security readout for executives and security teams

A very old flaw in Oracle 8.1.5 utilities could let someone already logged in on the server gain higher privileges by feeding an overly long ORACLE_HOME environment variable to certain Oracle helper programs. It is a local privilege issue, not a remote internet attack. Any business still running Oracle 8.1.5 today faces broader risk than this single bug because the product is long out of support. Exposure is limited to hosts still running Oracle 8.1.5, a database release that reached end-of-support many years ago. Attackers must already have local shell access to the database server. Modern environments should have no exposure; any remaining installs are almost certainly isolated legacy systems that carry many other unpatched risks beyond this specific overflow. Low priority as a standalone item, but treat it as a signal: if Oracle 8.1.5 exists in your estate, the real executive issue is running unsupported database software, not this single 2000-era bug. Fold remediation into a broader legacy-retirement plan rather than a one-off patch project. Mitigation focus: Retire or upgrade any Oracle 8.1.5 instances to a vendor-supported database release.; Restrict local shell access on database servers to a minimal set of trusted administrators.; Review and constrain SUID/SGID permissions on Oracle 8.1.5 client and listener binaries..

Prepared: Jul 12, 2026, 00:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2000-0986 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Nov 29, 2000, 05:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
oracle-home-bo(5390)CVE reference · vdb-entry, x_refsource_XF

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.