[NEWS] Oracle Enterprise Manager Directory Traversal Vulnerability
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 5 Feb 2007 17:47:48 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Oracle Enterprise Manager Directory Traversal Vulnerability
Oracle Enterprise Manager(OEM) is "a set of systems management tools
provided by Oracle Corporation for managing the Oracle environment. It
provides tools to monitor the Oracle environment and automate tasks (both
one-time and repetitive in nature) to take database administration a step
closer to "Lights Out" management". A vulnerability in the way Oracle
Enterprise Manager handles incoming HTTP requests, allows a remote
attacker to access files that would be otherwise in accessible to him.
* Oracle Enterprise Manager version 10g R2.
10g R2 Enterprise Manager by default listens on TCP port 1158.
In a normal HTTP instance a sample valid request would look something like
This translate to a PATH of:
Sample 'Attack Request'
* Discovered: 22 August 2006
* Released: 22 Auguest 2006
* Approved: 22 August June 2006
* Reported: 22 August 2006
* Fixed: 16 January 2007
* Published: 30 January 2007
The information has been provided by <mailto:mark@xxxxxxxxxxx> NGS.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] VMWare Workstation Guest Isolation Vulnerability
- Next by Date: [EXPL] Imail Buffer Overflow Exploit (RCPT TO)
- Previous by thread: [NEWS] VMWare Workstation Guest Isolation Vulnerability
- Next by thread: [EXPL] Imail Buffer Overflow Exploit (RCPT TO)