[NEWS] Oracle Enterprise Manager Directory Traversal Vulnerability



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Oracle Enterprise Manager Directory Traversal Vulnerability
------------------------------------------------------------------------


SUMMARY

Oracle Enterprise Manager(OEM) is "a set of systems management tools
provided by Oracle Corporation for managing the Oracle environment. It
provides tools to monitor the Oracle environment and automate tasks (both
one-time and repetitive in nature) to take database administration a step
closer to "Lights Out" management". A vulnerability in the way Oracle
Enterprise Manager handles incoming HTTP requests, allows a remote
attacker to access files that would be otherwise in accessible to him.

DETAILS

Vulnerable Systems:
* Oracle Enterprise Manager version 10g R2.

10g R2 Enterprise Manager by default listens on TCP port 1158.

In a normal HTTP instance a sample valid request would look something like
the following:
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=25C14C26F198301F559FBB5935F6285A.gif

This translate to a PATH of:
c:\oracle\product\10.2.0\db_1\oc4j\j2ee\oc4j_applications\em\em\images\
chartcache\25C14C26F198301F559FBB5935F6285A.gif

Sample 'Attack Request'
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt

Fix Information:

<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html> http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

TimeLine:
* Discovered: 22 August 2006
* Released: 22 Auguest 2006
* Approved: 22 August June 2006
* Reported: 22 August 2006
* Fixed: 16 January 2007
* Published: 30 January 2007


ADDITIONAL INFORMATION

The information has been provided by <mailto:mark@xxxxxxxxxxx> NGS.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were discovered in the (Oracle database server ... password is required to exploit this vulnerability. ...
    (Securiteam)
  • [EXPL] Oracle Command Line Overflow (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A locally exploitable buffer overflow has been found in the 'oracle' ... restricted sections of the database, ... 'print "A"x9850'` Segmentation fault ...
    (Securiteam)
  • [NEWS] Oracle Forms SQL Injection
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... part of the Oracle Developer Suite 10g". ... All Oracle Forms applications are by default vulnerable to SQL Injection. ... The following statement sends the result of the SQL statement: ...
    (Securiteam)
  • [EXPL] Oracle (extproc) Local/Remote Command Execution (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The attached PL/SQL code exploits the Oracle extproc directory traversal ... -- allows remote attackers to access arbitrary libraries outside of the ... create or replace package oracmd32 as ...
    (Securiteam)
  • [NEWS] Oracle Transparent Data Encryption Information Disclosure Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Oracle Transparent Data Encryption Information Disclosure Vulnerability ... The SGA is "the part of the RAM used by the ORACLE ...
    (Securiteam)