Here is explanation of vulnerability I did found.
This exploit cause Oracle instance DoS.
Tested with 11.1.0.6.0 win32.
What this exploit does is just sending NSPTCN packet with attempt to establish connection.
After that, Listener sending NSPTRS packet, offering to send the same NSPTCN packet, but to Oracle RDBMS instance.
Exploit send the same NSPTCN packet to Oracle instance and awaits for NSPTAC (accept) packet.
After, exploit send broken NA packet.
(Which is started with DEADBEEF signature).
Actually, exploit sending correct NA packet, but it also contain zero at random byte in it, so it is broken.
Usually, Oracle server raises this error:
"TNS-12699: Native service internal error"
... and it drops connection.
That's OK.
Exploit establish connection and sending broken NA packet one time per second, eternally. Note also, 'zero' position is different each time.
For testing, please start Oracle instance and make sure no one made connection to it. Because, actually, vulnerability is not stable. Or, in other words, I didn't find a away to exploit it stably.
Now run exploit and use victim's hostname as argument. And wait up to for one hour.
If I'm correct, this is a heap corruption problems. We can see this in traces:
"***** Internal heap ERROR kghfrh:ds addr=07AD0004 ds=0C2973E8 *****" Heap corruption detected while KGH memory freeing.
After, as in any software with a lot of allocated memory chunks and broken memory allocating structures, Oracle instance is becoming insance. It may write in "incident" folder reports about very strange things.
If I'm correct (I may not) this problem is related to nsdisc() function in network layer. Oracle instance closes connection uses this function. It frees some memory, but the same chunk of memory is used again for another connection.
→ [list of blog posts] Please drop me email about bug(s) and/or suggestion(s): my emails.