CVE-2009-1978
Oracle Secure Backup Administration Server Multiple Command Injection Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.
Vulnerabilidad no especificada en el componente Oracle Secure Backup en Oracle Secure Backup 10.2.0.3 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos. NOTA: la información anterior se obtuvo de la CPU de Oracle de Julio de 2009. Oracle no ha comentado sobre las alegaciones de un investigador independiente que esta vulnerabilidad permite a usuarios remotos autenticados ejecutar código arbitrario con privilegios de SYSTEM a través de vectores que implican a property_box.php.
This vulnerability allows remote attackers to inject arbitrary commands on vulnerable installations of Oracle Secure Backup. User interaction is not required to exploit this vulnerability but an attacker must be authenticated.
The specific flaw exists in the handling of various variables to the script property_box.php used in the administration server running on port 443. Due to improper filtering of user data a specially crafted request could lead to arbitrary commands being executed under the credentials of the SYSTEM account.
Oracle Secure Backup Administration Server suffers from authentication bypass and command injection vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-06-08 CVE Reserved
- 2009-07-14 CVE Published
- 2009-09-14 First Exploit
- 2024-02-22 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/55904 | Vdb Entry | |
| http://secunia.com/advisories/35776 | Third Party Advisory | |
| http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/35678 | Vdb Entry | |
| http://www.securitytracker.com/id?1022565 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2009/1900 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-09-059 | X_refsource_misc |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/51762 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/9652 | 2009-09-14 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Secure Backup Search vendor "Oracle" for product "Secure Backup" | 10.2.0.3 Search vendor "Oracle" for product "Secure Backup" and version "10.2.0.3" | - |
Affected
| ||||||