Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
BID:45883
Info
Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
| Bugtraq ID: | 45883 |
| Class: | Access Validation Error |
| CVE: |
CVE-2010-3600 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2011 12:00AM |
| Updated: | Jul 15 2015 12:14AM |
| Credit: | 1c239c43f521145fa8385d64a9c32243 |
| Vulnerable: |
Oracle Oracle11g Standard Edition One 11.1 6 Oracle Oracle11g Standard Edition 11.1 6 Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Standard Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.1 6 Oracle Oracle11g Enterprise Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.1.0.7 Oracle Enterprise Manager Grid Control 10g 10.2.0.5 |
| Not Vulnerable: | |
Discussion
Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
Oracle Database and Enterprise Manager Grid Control is prone to a remote code-execution vulnerability.
Successful exploits will allow attackers to execute arbitrary code within the context of the application.
This vulnerability affects Enterprise Manager Grid Control 10.2.0.5 on Oracle Database Server 11.1.0.7 and 11.2.0.1.
Oracle Database and Enterprise Manager Grid Control is prone to a remote code-execution vulnerability.
Successful exploits will allow attackers to execute arbitrary code within the context of the application.
This vulnerability affects Enterprise Manager Grid Control 10.2.0.5 on Oracle Database Server 11.1.0.7 and 11.2.0.1.
Exploit / POC
Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Oracle Database and Enterprise Manager Grid Control Remote Code Execution Vulnerability
References:
References:
- Oracle Critical Patch Update Advisory - January 2011 (Oracle)
- ZDI Security Advisory (Zero Day Initiative)