The October 31 variant has a harmless payload, but could easily be modified.
The December 29, 2005 version attempts to create private database links in affected databases, but the procedure to spread is missing. If activated, it will grant DBA to PUBLIC. An AFTER LOGON trigger may run which performs a Google search for its own code. The worm code tries to mail the username and password hashes to email@example.com and oracle@<random ip>. It tricks the listener to reset the password for a well known database user. The clear intention is to increase the chances of successfully creating a private link to the database.
The October 31 variant tries to find other Oracle databases in the same subnet and uses private database links to connect to remote databases. The December 29 variant was posted incomplete, without a spreading mechanism.