CVE-2010-4417

Related Files

Oracle BeeHive 2 Code Execution

Posted Dec 3, 2015

Authored by mr_me, sinn3r, 1c239c43f521145fa8385d64a9c32243 | Site metasploit.com

This Metasploit module exploits a vulnerability found in Oracle BeeHive. The processEvaluation method found in voice-servlet can be abused to write a malicious file onto the target machine, and gain remote arbitrary code execution under the context of SYSTEM.

tags | exploit, remote, arbitrary, code execution

advisories | CVE-2010-4417

SHA-256 | 0dd4b2592fada413038b4c9f336ee7ca63693bbb79a1842a8646d6ac30bff4df

Download | Favorite | View

Zero Day Initiative Advisory 11-020

Posted Jan 18, 2011

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 11-020 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Beehive. Authentication is not required to exploit this vulnerability. The specific flaw exists within 'voice-servlet/prompt-qa/Index.jspf'. During the creation of a file used for storing an evaluation parameter user supplied data is used to create a filename and another user specified field is later used to populate that file's contents. By inserting a null byte (0x00) into the filename the user can control the extension of the newly created file. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the oracle user.

tags | advisory, remote, arbitrary

advisories | CVE-2010-4417

SHA-256 | 8695d5670ace9b02fa453ba397c1729eeee23fac2228b9e55c71ce2e694e72a1

Download | Favorite | View