PT-2016-4248 · Oracle · Oracle Enterprise Manager Grid Control+1

Rgod · Publicado 2016-01-21 · Atualizado 2016-12-22 · CVE-2016-0488

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Grid Control versions 12.4.0.2 through 12.5.0.2

Description The issue affects confidentiality and integrity, potentially allowing remote attackers to bypass authentication and gain administrator access. It is related to Load Testing for Web Apps in the Oracle Application Testing Suite component. There are claims that this could be a directory traversal vulnerability in the isAllowedUrl function, which may allow attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication.

Recommendations For versions 12.4.0.2 and 12.5.0.2, consider restricting access to the admin pages as a temporary workaround until a patch is available. Avoid using URI entries that do not require authentication in the affected Load Testing for Web Apps component.

Correção

Identificadores relacionados

CVE-2016-0488

ZDI-16-035

Produtos afetados

Oracle Application Testing Suite

Oracle Enterprise Manager Grid Control

Referências · 7

• http://oracle.com/technetwork/topics/security/cpujan2016-2367955.html · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-16-035 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-035 · Nota
• https://osv.dev/vulnerability/CVE-2016-0488 · Aviso do Fabricante
• http://securitytracker.com/id/1034734 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0488 · Nota de Segurança
• http://securityfocus.com/bid/81104 · Nota