PT-2011-1412 · Oracle · Empop3Lib+1

Publicado 2011-01-19 · Atualizado 2018-10-10 · CVE-2010-3591

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 10.1.3.4 through 10.1.3.5

Description The issue affects confidentiality, integrity, and availability. It is related to Internal Operations in the Oracle Document Capture component. There are claims that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll).

Recommendations For Oracle Fusion Middleware versions 10.1.3.4 and 10.1.3.5, consider restricting access to the EMPOP3Lib ActiveX component (empop3.dll) to minimize the risk of exploitation. As a temporary workaround, avoid using the DownloadSingleMessageToFile method until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2010-3591

Produtos afetados

Empop3Lib

Oracle Fusion Middleware

Referências · 13

• 🔥 https://exploit-db.com/exploits/16053 · Exploit
• 🔥 https://exploit-db.com/exploits/16055 · Exploit
• 🔥 http://exploit-db.com/exploits/16055 · Exploit
• http://securityfocus.com/bid/45851 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3591 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0143 · Aviso do Fabricante
• http://securityfocus.com/archive/1/515959/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64768 · Nota
• http://dsecrg.com/pages/vul/show.php?id=305 · Nota
• http://secunia.com/advisories/42976 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3591 · Nota
• http://securitytracker.com/id?1024981 · Nota
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Aviso do Fabricante