PT-2011-1420 · Oracle · Ncsecwlib+1

Published 2011-01-19 · Updated 2018-10-10 · CVE-2010-3599

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 10.1.3.4 through 10.1.3.5

Description The issue affects the integrity and availability of the system, related to the Import Server in the Oracle Document Capture component. It is claimed that remote attackers can overwrite arbitrary files and execute arbitrary code via a full pathname in the first argument to the WriteJPG method in the NCSECWLib ActiveX control.

Recommendations For Oracle Fusion Middleware versions 10.1.3.4 and 10.1.3.5, consider restricting access to the Import Server and the NCSECWLib ActiveX control to minimize the risk of exploitation. As a temporary workaround, consider disabling the WriteJPG method in the NCSECWLib ActiveX control until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2010-3599

Affected Products

Ncsecwlib

Oracle Fusion Middleware

References · 11

• 🔥 https://exploit-db.com/exploits/16052 · Exploit
• http://vupen.com/english/advisories/2011/0143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3599 · Security Note
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Vendor Advisory
• http://dsecrg.com/pages/vul/show.php?id=306 · Note
• http://securityfocus.com/archive/1/515956/100/0/threaded · Note
• http://securitytracker.com/id?1024981 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3599 · Note
• http://secunia.com/advisories/42976 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64767 · Note
• http://securityfocus.com/bid/45856 · Note