CVE-2009-1977
Oracle Secure Backup Administration Server Authentication Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows attackers to bypass authentication via unknown vectors involving the username parameter and login.php.
Vulnerabilidad no especificada en el componente Oracle Secure Backup en Oracle Secure Backup v10.2.0.3 permite a los atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través e vectores desconocidos.
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Secure Backup. User interaction is not required to exploit this vulnerability.
The specific flaw exists in the logic used to authenticate a user to the administration server running on port 443. The script login.php does not properly sanitize the 'username' variable before using it in a database query. A specially crafted 'username' allows unauthorized attackers to log in with full administrative capabilities.
Oracle Secure Backup Administration Server suffers from authentication bypass and command injection vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-06-08 CVE Reserved
- 2009-07-14 CVE Published
- 2009-09-14 First Exploit
- 2024-08-07 CVE Updated
- 2024-11-10 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/55903 | Vdb Entry | |
| http://secunia.com/advisories/35776 | Third Party Advisory | |
| http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/35672 | Vdb Entry | |
| http://www.securitytracker.com/id?1022565 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2009/1900 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-09-058 | X_refsource_misc |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/51761 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/9652 | 2009-09-14 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Secure Backup Search vendor "Oracle" for product "Secure Backup" | 10.2.0.3 Search vendor "Oracle" for product "Secure Backup" and version "10.2.0.3" | - |
Affected
| ||||||