PT-2011-2643 · Oracle · Oracle Outside In Technology+1

Will Dormann · Published 2011-04-20 · Updated 2016-05-25 · CVE-2011-0794

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 8.3.5.0 Oracle Outside In Technology versions 8.3.5.x through 8.3.5.5684

Description The issue affects confidentiality, integrity, and availability. It is related to the File ID SDK. The vulnerability can be exploited when using the CAB file identification functionality to parse certain file formats, including OneNote (.onepkg) files.

Recommendations For Oracle Fusion Middleware version 8.3.5.0, update to a version that is not affected by this issue. For Oracle Outside In Technology versions 8.3.5.x through 8.3.5.5684, consider restricting access to the sccut.dll or libsc ut.so libraries until a patch is available. As a temporary workaround, avoid using the CAB file identification functionality to parse OneNote (.onepkg) files and other formats until the issue is resolved.

Fix

Related Identifiers

CVE-2011-0794

Affected Products

Oracle Fusion Middleware

Oracle Outside In Technology

References · 9

• http://oracle.com/technetwork/topics/security/cpuapr2011-301950.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0794 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa · Vendor Advisory
• http://secunia.com/advisories/44295 · Vendor Advisory
• http://securityfocus.com/bid/47437 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0794 · Note
• http://kb.cert.org/vuls/id/520721 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21660640 · Note
• http://novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=7009213&sliceId=1&docTypeID=DT_TID_1_1&dialogID=268451045&stateId=0%200%20268449309 · Note