Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a \CREATE DATABASE LINK\ query containing a connect string with a long USING parameter.