PT-2014-4688 · Oracle · Oracle Event Processing+1

Publicado 2014-04-16 · Atualizado 2014-07-24 · CVE-2014-2424

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.7.0

Description The issue affects the integrity of the system, allowing remote authenticated users to exploit it via vectors related to the CEP system in the Oracle Event Processing component. This can potentially lead to remote code execution.

Recommendations For Oracle Fusion Middleware version 11.1.1.7.0, consider restricting access to the FileUploadServlet to minimize the risk of exploitation until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2014-2424

ZDI-14-106

Produtos afetados

Oracle Event Processing

Oracle Fusion Middleware

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/oracle_event_processing_upload.rb · Exploit
• 🔥 http://exploit-db.com/exploits/33989 · Exploit
• 🔥 https://exploit-db.com/exploits/33989 · Exploit
• http://packetstormsecurity.com/files/127365/Oracle-Event-Processing-FileUploadServlet-Arbitrary-File-Upload.html · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2014-1972952.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2424 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-14-106 · Nota de Segurança
• http://osvdb.org/105844 · Nota
• http://securityfocus.com/bid/66871 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2424 · Nota