| Name | Oracle.Secure.Backup.EXEC.QR.URI.Command.Injection |
| Release Date | Jan 05, 2010 |
| Severity | Critical |
| Impact | System Compromise: Remote attackers can gain control of vulnerable systems. |
| Description | This indicates an attack attempt against a command-injection vulnerability in Oracle Secure Backup.
A vulnerability has been reported in Oracle Secure Backup that may allow an attacker to execute shell commands on a vulnerable system. This is possible because the user input filters fail to properly sanitize the "ora_osb_lcookie", "ora_osb_bgcookie", and "rbtool" parameter values that are passed to "login.php". An attacker may include shell commands by supplying an injection string through the URL and a good string through POST or the COOKIE. |
| Affected Products | Oracle Secure Backup 10.2.0.3
Oracle Secure Backup 10.2.0.2
Oracle Secure Backup 10.1.0.3
Oracle Secure Backup 10.1.0.2
Oracle Secure Backup 10.1.0.1 |
| Recommended Actions | Apply the patch available at the following web site:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html. |
| Common Vulnerabilities and Exposures (CVE) | http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-5448
|
| Reference/s | http://www.securityfocus.com/bid/33177 (BugTraq)
|