Oracle Enterprise Manager Grid Control CVE-2010-2390 Remote EM Console Vulnerability

Bugtraq ID:	43945
Class:	Unknown
CVE:	CVE-2010-2390
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 14 2010 08:39PM
Credit:	Oracle
Vulnerable:	Oracle Oracle10g Standard Edition 10.2 .3 R2 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2 .2 Oracle Oracle10g Standard Edition 10.2 .1 Oracle Oracle10g Standard Edition 10.1 .5 R1 Oracle Oracle10g Standard Edition 10.1 .5 Oracle Oracle10g Standard Edition 10.1 .4.2 Oracle Oracle10g Standard Edition 10.1 .4 Oracle Oracle10g Standard Edition 10.1 .0.5 Oracle Oracle10g Standard Edition 10.1 .0.4 Oracle Oracle10g Standard Edition 10.1 .0.3.1 Oracle Oracle10g Standard Edition 10.1 .0.3 Oracle Oracle10g Standard Edition 10.1 .0.2 Oracle Oracle10g Standard Edition 10.2 Oracle Oracle10g Personal Edition 10.2 .3 R2 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2 .2 r2 Oracle Oracle10g Personal Edition 10.2 .2 Oracle Oracle10g Personal Edition 10.2 .1 r2 Oracle Oracle10g Personal Edition 10.2 .1 Oracle Oracle10g Personal Edition 10.1 .5 r1 Oracle Oracle10g Personal Edition 10.1 .5 Oracle Oracle10g Personal Edition 10.1 .4.2 r1 Oracle Oracle10g Personal Edition 10.1 .4 r1 Oracle Oracle10g Personal Edition 10.1 .4 Oracle Oracle10g Personal Edition 10.1 .3 r1 Oracle Oracle10g Personal Edition 10.1 .0.4 Oracle Oracle10g Personal Edition 10.1 .0.3.1 Oracle Oracle10g Personal Edition 10.1 .0.3 Oracle Oracle10g Personal Edition 10.1 .0.2 Oracle Oracle10g Personal Edition 10.2 Oracle Oracle10g Enterprise Edition 10.2 .3 R2 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2 .2 Oracle Oracle10g Enterprise Edition 10.2 .1 Oracle Oracle10g Enterprise Edition 10.1 .5 R1 Oracle Oracle10g Enterprise Edition 10.1 .5 Oracle Oracle10g Enterprise Edition 10.1 .4.2 Oracle Oracle10g Enterprise Edition 10.1 .4 Oracle Oracle10g Enterprise Edition 10.1 .0.4 Oracle Oracle10g Enterprise Edition 10.1 .0.3.1 Oracle Oracle10g Enterprise Edition 10.1 .0.3 Oracle Oracle10g Enterprise Edition 10.1 .0.2 Oracle Oracle10g Enterprise Edition 10.2.0.4 R2 Oracle Oracle10g Enterprise Edition 10.2.0.2 64 bit Oracle Oracle10g Enterprise Edition 10.2 Oracle Fusion Middleware 10.1.4 .3 Oracle Fusion Middleware 10.1.4 .2 Oracle Fusion Middleware 10.1.2 .3 Oracle Enterprise Manager Grid Control 10g 10.2 .1 Oracle Enterprise Manager Grid Control 10g 10.1 .5 Oracle Enterprise Manager Grid Control 10g 10.1 .4 Oracle Enterprise Manager Grid Control 10g 10.1 .3 Oracle Enterprise Manager Grid Control 10g 10.1 .0.2
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2010-2390 Remote EM Console Vulnerability

Oracle Enterprise Manager Grid Control is prone to a remote buffer-overflow vulnerability in EM Console.

The vulnerability can be exploited over the 'HTTP' protocol. An attacker does not require privileges to exploit this vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Failed exploit attempts can result in a denial-of-service condition.

Oracle Enterprise Manager Grid Control CVE-2010-2390 Remote EM Console Vulnerability

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Oracle Enterprise Manager Grid Control CVE-2010-2390 Remote EM Console Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Enterprise Manager Grid Control CVE-2010-2390 Remote EM Console Vulnerability

References:

• Update Release Notes: Changes in 1.6.0_22 (6u22) (Oracle)
  
• VUPEN Security Research - Oracle Products HTTP Request Remote Buffer Overflow Vu ("VUPEN Security Research" )
  
• Oracle Critical Patch Update Advisory - October 2010 (Oracle)