PT-2013-3238 · Oracle · Oracle Webcenter Content+1

Publicado 2013-04-17 · Atualizado 2013-10-11 · CVE-2013-1559

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content versions 10.1.3.5.1 through 11.1.1.6.0

Description The issue allows remote authenticated users to affect availability via unknown vectors related to Content Server. It is also related to a remote code execution vulnerability in the CheckOutAndOpen.dll ActiveX component, specifically in the coao/openWebdav functionality.

Recommendations For versions 10.1.3.5.1 and 11.1.1.6.0, consider restricting access to the Content Server component until a patch is available. As a temporary workaround, consider disabling the CheckOutAndOpen.dll ActiveX component to minimize the risk of exploitation. Avoid using the coao/openWebdav functionality in the affected ActiveX component until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2013-1559

ZDI-13-094

Produtos afetados

Checkoutandopen.Dll

Oracle Webcenter Content

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb · Exploit
• 🔥 https://exploit-db.com/exploits/25979 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1559 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-13-094 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpuapr2013-1899555.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1559 · Nota