Oracle Outside In Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	34994
Class:	Unknown
CVE:	CVE-2009-1009 CVE-2009-1010 CVE-2009-1011
Remote:	Yes
Local:	No
Published:	Apr 09 2009 12:00AM
Updated:	May 19 2009 07:20PM
Credit:	Joshua J. Drake of iDefense Labs.
Vulnerable:	Oracle Outside In SDK HTML Export 8.3 Oracle Outside In SDK HTML Export 8.2.2 Oracle Outside In 8.3.0.5129 Oracle Outside In 8.2.2.4866 Oracle Outside In 8.1.9.4417 Oracle Outside In 8.1.5.4282 Good Technologies Good Mobile Messaging Server for Exchange 6.0.0.106 Good Technologies Good Mobile Messaging Server for Exchange 5.0.4.28 Good Technologies Good Mobile Messaging Server for Exchange 4.9.3.41
Not Vulnerable:

Oracle Outside In Multiple Buffer Overflow Vulnerabilities

Oracle Outside In is prone to multiple buffer-overflow vulnerabilities because the software fails to properly bounds-check user-supplied input.

An attacker can exploit these issue by tricking a victim into opening a specially crafted file with an application using the affected library. Successful exploits will allow arbitrary code to run in the context of the user running the affected application.

NOTE: These issues were previously covered in BID 34461 (Oracle April 2009 Critical Patch Update Multiple Vulnerabilities), but have been given their own record to better document them.

Oracle Outside In Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Outside In Multiple Buffer Overflow Vulnerabilities

Solution:
Vendor updates are available. Contact the vendor for more information.


Good Technologies Good Mobile Messaging Server for Exchange 5.0.4.28

• Good Technologies gmm_server_exchange_5_0_4_53_HotFix.exe
  ftp://goodcust:[email protected]/gmm_server_exchange_5_0_4_53_HotF ix.exe

Good Technologies Good Mobile Messaging Server for Exchange 6.0.0.106

• Good Technologies gmm_server_exchange_6_0_0_125_hotfix.exe
  ftp://goodcust:[email protected]/gmm_server_exchange_6_0_0_125_hot fix.exe

Oracle Outside In Multiple Buffer Overflow Vulnerabilities

References:

• Oracle Homepage (Oracle)
  
• iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem (iDefense Labs )
  
• iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Multiple Integer (iDefense Labs )
  
• iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Multiple Spreads (iDefense Labs )
  
• iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Spreadsheet Buff (iDefense Labs )
  
• 18431 - Good Mobile Messaging - Security Bulletin (Good Technologies)
  
• Multiple Vendor Outside In Multiple Integer Overflow Vulnerabilities (iDefense)
  
• Multiple Vendor Outside In Multiple Spreadsheet Buffer Overflow Vulnerabilities (iDefense)
  
• Multiple Vendor Outside In Spreadsheet Buffer Overflow Vulnerability (iDefense)
  
• Multiple Vendor Outside In Spreadsheet Integer Overflow Vulnerability (iDefense)
  
• Oracle Critical Patch Update Advisory - April 2009 (Oracle)
  
• Oracle Critical Patch Update Pre-Release Announcement - April 2009 (Oracle)