|
|
| |
Credit:
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-120/
|
| |
Vulnerable Systems:
* Oracle Secure Backup
Authentication is required to exploit this vulnerability. The specific flaw exists in the handling of variables to the property_box.php script located on the Oracle Secure Backup administration server. Due to the lack of filtering on special characters it is possible to specify arbitrary commands to the command line being executed by the administration server. Successful exploitation of this can lead to remote compromise under the credentials of the web server.
Patch Availability:
Oracle has issued an update to correct this vulnerability. More details can be found at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2010.html
CVE Information:
CVE-2010-0906
Disclosure Timeline:
2009-10-21 - Vulnerability reported to vendor
2010-07-13 - Coordinated public release of advisory
|
|
|
