PT-2011-1416 · Oracle · Emsmtp.Dll+1

Alexey Sintsov · Published 2011-01-19 · Updated 2018-10-10 · CVE-2010-3595

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 10.1.3.4 through 10.1.3.5

Description The issue affects confidentiality and is related to the Import Server in the Oracle Document Capture component. Details about exploitation include the ImportBodyText method in the emsmtp.dll ActiveX control, where attackers may be able to read arbitrary files by providing a full pathname as the first argument.

Recommendations For Oracle Fusion Middleware versions 10.1.3.4 and 10.1.3.5, consider restricting access to the Import Server and the EasyMail ActiveX control until a fix is available. As a temporary workaround, avoid using the ImportBodyText method in the emsmtp.dll control with untrusted input.

Exploit

Fix

Related Identifiers

CVE-2010-3595

Affected Products

Oracle Fusion Middleware

Emsmtp.Dll

References · 12

• 🔥 http://exploit-db.com/exploits/16056 · Exploit
• 🔥 https://exploit-db.com/exploits/16056 · Exploit
• http://vupen.com/english/advisories/2011/0143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3595 · Security Note
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3595 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64770 · Note
• http://dsecrg.com/pages/vul/show.php?id=307 · Note
• http://securityfocus.com/bid/45849 · Note
• http://secunia.com/advisories/42976 · Note
• http://securityfocus.com/archive/1/515957/100/0/threaded · Note
• http://securitytracker.com/id?1024981 · Note