[NEWS] Oracle Enterprise Manager Directory Traversal Vulnerability



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Oracle Enterprise Manager Directory Traversal Vulnerability
------------------------------------------------------------------------


SUMMARY

Oracle Enterprise Manager(OEM) is "a set of systems management tools
provided by Oracle Corporation for managing the Oracle environment. It
provides tools to monitor the Oracle environment and automate tasks (both
one-time and repetitive in nature) to take database administration a step
closer to "Lights Out" management". A vulnerability in the way Oracle
Enterprise Manager handles incoming HTTP requests, allows a remote
attacker to access files that would be otherwise in accessible to him.

DETAILS

Vulnerable Systems:
* Oracle Enterprise Manager version 10g R2.

10g R2 Enterprise Manager by default listens on TCP port 1158.

In a normal HTTP instance a sample valid request would look something like
the following:
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=25C14C26F198301F559FBB5935F6285A.gif

This translate to a PATH of:
c:\oracle\product\10.2.0\db_1\oc4j\j2ee\oc4j_applications\em\em\images\
chartcache\25C14C26F198301F559FBB5935F6285A.gif

Sample 'Attack Request'
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt

Fix Information:

<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html> http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

TimeLine:
* Discovered: 22 August 2006
* Released: 22 Auguest 2006
* Approved: 22 August June 2006
* Reported: 22 August 2006
* Fixed: 16 January 2007
* Published: 30 January 2007


ADDITIONAL INFORMATION

The information has been provided by <mailto:mark@xxxxxxxxxxx> NGS.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.