From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 5 Feb 2007 17:47:48 +0200
Subject: [NEWS] Oracle Enterprise Manager Directory Traversal Vulnerability
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20070205153212.1EFB857B0@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
X-Spam-Status: No, hits=2.387 tagged_above=2 required=5
tests=MSGID_FROM_MTA_ID, NORMAL_HTTP_TO_IP, WEIRD_PORT
X-Spam-Level: **
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Oracle Enterprise Manager Directory Traversal Vulnerability
------------------------------------------------------------------------
SUMMARY
Oracle Enterprise Manager(OEM) is "a set of systems management tools
provided by Oracle Corporation for managing the Oracle environment. It
provides tools to monitor the Oracle environment and automate tasks (both
one-time and repetitive in nature) to take database administration a step
closer to "Lights Out" management". A vulnerability in the way Oracle
Enterprise Manager handles incoming HTTP requests, allows a remote
attacker to access files that would be otherwise in accessible to him.
DETAILS
Vulnerable Systems:
* Oracle Enterprise Manager version 10g R2.
10g R2 Enterprise Manager by default listens on TCP port 1158.
In a normal HTTP instance a sample valid request would look something like
the following:
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=25C14C26F198301F559FBB5935F6285A.gif
This translate to a PATH of:
c:\oracle\product\10.2.0\db_1\oc4j\j2ee\oc4j_applications\em\em\images\
chartcache\25C14C26F198301F559FBB5935F6285A.gif
Sample 'Attack Request'
http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?
beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt
Fix Information:
<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html>; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
TimeLine:
* Discovered: 22 August 2006
* Released: 22 Auguest 2006
* Approved: 22 August June 2006
* Reported: 22 August 2006
* Fixed: 16 January 2007
* Published: 30 January 2007
ADDITIONAL INFORMATION
The information has been provided by <mailto:mark@jibbery.com.> NGS.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
