PT-2016-4252 · Oracle · Oracle Enterprise Manager Grid Control

Zhou Yu · Published 2016-01-21 · Updated 2016-12-22 · CVE-2016-0492

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Grid Control versions 12.4.0.2 through 12.5.0.2

Description The issue affects confidentiality and integrity, potentially allowing remote attackers to bypass authentication. It is related to Load Testing for Web Apps. There are claims that this could be a directory traversal vulnerability in the isAllowedUrl function, which may allow attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, such as /olt/Login.do/../../olt/UploadFileUpload.do.

Recommendations For versions 12.4.0.2 and 12.5.0.2, consider restricting access to the Load Testing for Web Apps component until a patch is available. As a temporary workaround, consider disabling the isAllowedUrl function to prevent potential directory traversal attacks. Avoid using URI entries that do not require authentication in the affected Load Testing for Web Apps component until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2016-0492

ZDI-16-042

Affected Products

Oracle Enterprise Manager Grid Control

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_ats_file_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/39852 · Exploit
• 🔥 https://exploit-db.com/exploits/39691 · Exploit
• 🔥 http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-0492 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-042 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0492 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpujan2016-2367955.html · Vendor Advisory
• http://securitytracker.com/id/1034734 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-042 · Note
• http://rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload · Note
• http://securityfocus.com/bid/81158 · Note