Oracle Outside In Technology CVE-2012-1771 Remote Code Execution Vulnerability

Bugtraq ID:	54543
Class:	Unknown
CVE:	CVE-2012-1771
Remote:	Yes
Local:	No
Published:	Jul 17 2012 12:00AM
Updated:	Mar 19 2015 09:46AM
Credit:	Oracle
Vulnerable:	Symantec Enterprise Vault 10.0 Microsoft Office SharePoint Server 2010 SP1 Microsoft Exchange Server 2007 SP3 Microsoft Exchange Server 2007 SP2 Microsoft Exchange Server 2007 SP 1 Microsoft Exchange Server 2007 SP3 McAfee Security for Microsoft Exchange 7.6 McAfee Host Data Loss Prevention 9.0 McAfee Email Gateway 7.0 Patch 1 McAfee Email Gateway 7.0 McAfee Email and Web Security Appliance 5.6 Patch 3 McAfee Email and Web Security Appliance 5.5 Patch 6 McAfee Email and Web Security Appliance 5.1 Patch 4 McAfee Email and Web Security Appliance 5.1 AccessData Group FTK 3.4 AccessData Group FTK 3.3 AccessData Group FTK 3.2
Not Vulnerable:	Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2000 SP3

Oracle Outside In Technology CVE-2012-1771 Remote Code Execution Vulnerability

Oracle Outside In Technology is prone to a remote code-execution vulnerability.

The 'Outside In Filters' sub component is affected.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

This vulnerability affects the following supported versions:
8.3.5, 8.3.7

Oracle Outside In Technology CVE-2012-1771 Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Outside In Technology CVE-2012-1771 Remote Code Execution Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.


Microsoft Exchange Server 2007 SP3

• Microsoft Update Rollup 8 for Exchange Server 2007 Service Pack 3 (KB2734323)
  http://www.microsoft.com/downloads/details.aspx?familyid=e894bd54-9c21 -45cd-be69-2621969a07d8

Microsoft Exchange Server 2010 SP1

• Microsoft Update Rollup 7 for Exchange Server 2010 Service Pack 1 (KB2743248)
  http://www.microsoft.com/downloads/details.aspx?familyid=edc7f100-3725 -46e2-99d9-1a9ac78e7038

Microsoft Exchange Server 2010 SP2

• Microsoft Update Rollup 4 for Exchange Server 2010 Service Pack 2 (KB2706690)
  http://www.microsoft.com/downloads/details.aspx?familyid=5b71196e-3918 -4716-af12-151af527e908

Microsoft FAST Search Server 2010 for SharePoint Service Pack 1 0

• Microsoft Security Update for Microsoft FAST Search Server 2010 (KB2553402)
  http://www.microsoft.com/en-us/download/details.aspx?id=34904

Microsoft FAST Search Server 2010 for SharePoint 0

• Microsoft Security Update for Microsoft FAST Search Server 2010 (KB2553402)
  http://www.microsoft.com/en-us/download/details.aspx?id=34904

Oracle Outside In Technology CVE-2012-1771 Remote Code Execution Vulnerability

References:

• Oracle Homepage (Oracle)
  
• Oracle Outside In vulnerabilities with McAfee Security for Microsoft Exchange 7. (McAfee)
  
• Security for Microsoft SharePoint 2.5.1 Hotfix 788524 Release Notes (McAfee)
  
• AccessData Information for VU#118913 (AccessData Group)
  
• ACD Systems International Information for VU#118913 (ACD Systems International)
  
• Guidance Software, Inc. Information for VU#118913 (Guidance Software)
  
• McAfee Security Bulletin - Updates fix Oracle 'Outside In' vulnerabilities for m (McAfee)
  
• Microsoft Security Bulletin MS12-058 (Microsoft)
  
• Microsoft Security Bulletin MS12-067 - Important (Microsoft)
  
• Oracle Critical Patch Update Advisory - July 2012 (Oracle)
  
• Oracle Outside In contains multiple exploitable vulnerabilities (US-CERT)
  
• Security Advisories Relating to Symantec Products - Symantec Enterprise Vault Up (Symantec)
  
• Vulnerabilities in Microsoft Exchange and FAST Search Server 2010 for SharePoint (Microsoft)