CVE-2016-0489

Oracle Application Testing Suite ReportImage tempfilename Parameter Directory Traversal Remote Code Execution Vulnerability

Severity Score

6.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.

Vulnerabilidad no especificada en el componente Oracle Application Testing Suite en Oracle Enterprise Manager Grid Control 12.4.0.2 y 12.5.0.2 permite a usuarios remotos autenticados afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Test Manager for Web Apps. NOTA: la información anterior es de la CPU de Enero de 2016. Oracle no ha comentado sobre las reclamaciones de terceros que esto es una vulnerabilidad de salto de directorio en el servlet ActionServlet, lo que permite a usuarios remotos autenticados cargar y ejecutar archivos arbitrarios a través de secuencias de salto de directorio en el parámetro tempfilename en una acción ReportImage.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Application Testing Suite. Authentication is required but can be bypassed.
The specific vulnerability is exposed by the ActionServlet servlet. In the ReportImage action, the tempfilename parameter is vulnerable to directory traversal. An attacker could leverage this to execute arbitrary code under the context of SYSTEM.

*Credits: rgod

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-12-09 CVE Reserved
2016-01-21 CVE Published
2024-03-20 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (4)

URL	Tag	Source
http://www.securityfocus.com/bid/81184	Third Party Advisory
http://www.securitytracker.com/id/1034734	Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-16-038	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	2016-12-22

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				12.4.0.2 Search vendor "Oracle" for product "Application Testing Suite" and version "12.4.0.2"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				12.5.0.2 Search vendor "Oracle" for product "Application Testing Suite" and version "12.5.0.2"		-		Affected