PT-2011-1416 · Oracle · Emsmtp.Dll+1

Alexey Sintsov · Publicado 2011-01-19 · Atualizado 2018-10-10 · CVE-2010-3595

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 10.1.3.4 through 10.1.3.5

Description The issue affects confidentiality and is related to the Import Server in the Oracle Document Capture component. Details about exploitation include the ImportBodyText method in the emsmtp.dll ActiveX control, where attackers may be able to read arbitrary files by providing a full pathname as the first argument.

Recommendations For Oracle Fusion Middleware versions 10.1.3.4 and 10.1.3.5, consider restricting access to the Import Server and the EasyMail ActiveX control until a fix is available. As a temporary workaround, avoid using the ImportBodyText method in the emsmtp.dll control with untrusted input.

Exploit

Correção

Identificadores relacionados

CVE-2010-3595

Produtos afetados

Oracle Fusion Middleware

Emsmtp.Dll

Referências · 12

• 🔥 http://exploit-db.com/exploits/16056 · Exploit
• 🔥 https://exploit-db.com/exploits/16056 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3595 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64770 · Nota
• http://dsecrg.com/pages/vul/show.php?id=307 · Nota
• http://vupen.com/english/advisories/2011/0143 · Aviso do Fabricante
• http://securityfocus.com/bid/45849 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3595 · Nota de Segurança
• http://secunia.com/advisories/42976 · Nota
• http://securityfocus.com/archive/1/515957/100/0/threaded · Nota
• http://securitytracker.com/id?1024981 · Nota
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Aviso do Fabricante