PT-2010-2627 · Oracle · Oracle Secure Backup

Mc · Publicado 2010-07-13 · Atualizado 2012-10-23 · CVE-2010-0904

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Secure Backup version 10.3.0.1

Description The issue allows remote attackers to affect integrity, potentially via an authentication bypass vulnerability in the administration interface, specifically related to uname authentication.

Recommendations For Oracle Secure Backup version 10.3.0.1, consider restricting access to the administration interface as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2010-0904

ZDI-10-118

ZDI-10-123

Produtos afetados

Oracle Secure Backup

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/oracle/osb_execqr3.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/osb_uname_jlist.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17698 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-10-118 · Nota de Segurança
• http://securityreason.com/securityalert/8356 · Nota
• http://securityreason.com/securityalert/8354 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0904 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-10-123 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpuoct2010-175626.html · Nota