PT-2010-2627 · Oracle · Oracle Secure Backup

Mc · Published 2010-07-13 · Updated 2012-10-23 · CVE-2010-0904

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Secure Backup version 10.3.0.1

Description The issue allows remote attackers to affect integrity, potentially via an authentication bypass vulnerability in the administration interface, specifically related to uname authentication.

Recommendations For Oracle Secure Backup version 10.3.0.1, consider restricting access to the administration interface as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2010-0904

ZDI-10-118

ZDI-10-123

Affected Products

Oracle Secure Backup

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/oracle/osb_execqr3.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/osb_uname_jlist.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17698 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-10-118 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0904 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-10-123 · Security Note
• http://securityreason.com/securityalert/8356 · Note
• http://securityreason.com/securityalert/8354 · Note
• http://oracle.com/technetwork/topics/security/cpuoct2010-175626.html · Note