PT-2011-1412 · Oracle · Empop3Lib+1

Published 2011-01-19 · Updated 2018-10-10 · CVE-2010-3591

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 10.1.3.4 through 10.1.3.5

Description The issue affects confidentiality, integrity, and availability. It is related to Internal Operations in the Oracle Document Capture component. There are claims that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll).

Recommendations For Oracle Fusion Middleware versions 10.1.3.4 and 10.1.3.5, consider restricting access to the EMPOP3Lib ActiveX component (empop3.dll) to minimize the risk of exploitation. As a temporary workaround, avoid using the DownloadSingleMessageToFile method until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2010-3591

Affected Products

Empop3Lib

Oracle Fusion Middleware

References · 13

• 🔥 https://exploit-db.com/exploits/16053 · Exploit
• 🔥 https://exploit-db.com/exploits/16055 · Exploit
• 🔥 http://exploit-db.com/exploits/16055 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3591 · Security Note
• http://vupen.com/english/advisories/2011/0143 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Vendor Advisory
• http://securityfocus.com/bid/45851 · Note
• http://securityfocus.com/archive/1/515959/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64768 · Note
• http://dsecrg.com/pages/vul/show.php?id=305 · Note
• http://secunia.com/advisories/42976 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3591 · Note
• http://securitytracker.com/id?1024981 · Note