By exploiting this vulnerability, a remote unauthenticated attacker might be able to access or modify all the business information processed by the ERP system.
If a specially crafted message is sent to the JD Edwards server, running processes of XMLCallObject Kernel, then arbitrary commands can be executed through the JD Edwards CallObject Kernel process.
Further technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patchtheir systems and protect against the exploitation of the described vulnerability.
Disclosure Timeline:
2010-09-20: Vulnerability information to Oracle.
2010-09-21: Oracle confirms reception of vulnerability submission.
2010-09-24: Oracle states vulnerability is under investigation.
2010-10-07: Oracle confirms vulnerability.
2011-04-19: Oracle releases fixes in CPU.
2011-04-27: Security advisory released.
