[NEWS] Oracle Enterprise Manager Directory Traversal Vulnerability
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 5 Feb 2007 17:47:48 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Oracle Enterprise Manager Directory Traversal Vulnerability
------------------------------------------------------------------------
SUMMARY
Oracle Enterprise Manager(OEM) is "a set of systems management tools
provided by Oracle Corporation for managing the Oracle environment. It
provides tools to monitor the Oracle environment and automate tasks (both
one-time and repetitive in nature) to take database administration a step
closer to "Lights Out" management". A vulnerability in the way Oracle
Enterprise Manager handles incoming HTTP requests, allows a remote
attacker to access files that would be otherwise in accessible to him.
DETAILS
Vulnerable Systems:
* Oracle Enterprise Manager version 10g R2.
10g R2 Enterprise Manager by default listens on TCP port 1158.
In a normal HTTP instance a sample valid request would look something like
the following:
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=25C14C26F198301F559FBB5935F6285A.gif
This translate to a PATH of:
c:\oracle\product\10.2.0\db_1\oc4j\j2ee\oc4j_applications\em\em\images\
chartcache\25C14C26F198301F559FBB5935F6285A.gif
Sample 'Attack Request'
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt
Fix Information:
<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html> http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
TimeLine:
* Discovered: 22 August 2006
* Released: 22 Auguest 2006
* Approved: 22 August June 2006
* Reported: 22 August 2006
* Fixed: 16 January 2007
* Published: 30 January 2007
ADDITIONAL INFORMATION
The information has been provided by <mailto:mark@xxxxxxxxxxx> NGS.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] VMWare Workstation Guest Isolation Vulnerability
- Next by Date: [EXPL] Imail Buffer Overflow Exploit (RCPT TO)
- Previous by thread: [NEWS] VMWare Workstation Guest Isolation Vulnerability
- Next by thread: [EXPL] Imail Buffer Overflow Exploit (RCPT TO)
- Index(es):
Relevant Pages
- [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were
discovered in the (Oracle database server ... password is required to exploit this vulnerability.
... (Securiteam) - [EXPL] Oracle Command Line Overflow (Exploit)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... A locally exploitable buffer overflow
has been found in the 'oracle' ... restricted sections of the database, ...
'print "A"x9850'` Segmentation fault ... (Securiteam) - [NEWS] Oracle Forms SQL Injection
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... part of the Oracle Developer
Suite 10g". ... All Oracle Forms applications are by default vulnerable to SQL Injection.
... The following statement sends the result of the SQL statement: ... (Securiteam) - [EXPL] Oracle (extproc) Local/Remote Command Execution (Exploit)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... The attached PL/SQL code exploits
the Oracle extproc directory traversal ... -- allows remote attackers to access arbitrary
libraries outside of the ... create or replace package oracmd32 as ... (Securiteam) - [NEWS] Oracle Database 9ir2 Interval Conversion Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Oracle Database Server
provides two functions that can be used with PL/SQL ... Exploitation of these vulnerabilities
becomes easy if Oracle ... (Securiteam)
