Juniper Networks
Solutions
Products & Services
Company
Partners
Support
Education

Signature Detail

Security Intelligence Center
Signatures
Print

Short Name

 HTTP:ORACLE:LOGIN-COOKIES-INJ

Severity

 High

Recommended

 Yes

Recommended Action

 Drop

Category

 HTTP

Keywords

 Oracle Secure Backup Administration Server login.php Cookies Command Injection

Release Date

 2011/07/18

Update Number

 1956

Supported Platforms

 idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+

HTTP: Oracle Secure Backup Administration Server login.php Cookies Command Injection


There exists a command injection vulnerability in Oracle Secure Backup. The vulnerability is due to lack of sanitation of user supplied parameters when processing HTTP requests sent to CGI program login.php. Remote unauthenticated attackers can exploit this vulnerability by sending a crafted HTTP request to the target host. Successful exploitation would allow for arbitrary command execution in the security context of the user running the web server of Oracle Secure Backup. The behaviour of the target is entirely dependent on the intended function of the injected command.

Extended Description

Oracle has released the January 2009 critical patch update. The update addresses 41 vulnerabilities affecting the following software: Oracle Database Oracle Secure Backup Oracle TimesTen In-Memory Database Oracle Application Server Oracle Collaboration Suite Oracle E-Business Suite Release Oracle Enterprise Manager Grid Control PeopleSoft Enterprise HRMS JD Edwards Tools Oracle WebLogic Server (formerly BEA WebLogic Server) Oracle WebLogic Portal (formerly BEA WebLogic Portal)

Affected Products

  • BEA Systems WebLogic Portal 10.0
  • BEA Systems WebLogic Portal 10.0 MP1
  • BEA Systems WebLogic Portal 10.2
  • BEA Systems WebLogic Portal 10.3
  • BEA Systems WebLogic Portal 8.1.0
  • BEA Systems WebLogic Portal 8.1.0 SP1
  • BEA Systems WebLogic Portal 8.1.0 SP2
  • BEA Systems WebLogic Portal 8.1.0 SP3
  • BEA Systems WebLogic Portal 8.1.0 SP4
  • BEA Systems WebLogic Portal 8.1.0 SP5
  • BEA Systems WebLogic Portal 8.1.0 SP6
  • BEA Systems WebLogic Portal 9.2
  • BEA Systems WebLogic Portal 9.2 MP3
  • BEA Systems Weblogic Server 10.0
  • BEA Systems Weblogic Server 10.0 MP1
  • BEA Systems Weblogic Server 10.3
  • BEA Systems Weblogic Server 7.0.0
  • BEA Systems Weblogic Server 7.0.0 .0.1
  • BEA Systems Weblogic Server 7.0.0 .0.1 SP 1
  • BEA Systems Weblogic Server 7.0.0 .0.1 SP 2
  • BEA Systems Weblogic Server 7.0.0 .0.1 SP 3
  • BEA Systems Weblogic Server 7.0.0 .0.1 SP 4
  • BEA Systems Weblogic Server 7.0.0 SP 1
  • BEA Systems Weblogic Server 7.0.0 SP 2
  • BEA Systems Weblogic Server 7.0.0 SP 3
  • BEA Systems Weblogic Server 7.0.0 SP 4
  • BEA Systems Weblogic Server 7.0.0 SP 5
  • BEA Systems Weblogic Server 7.0.0 SP 6
  • BEA Systems Weblogic Server 7.0.0 SP 7
  • BEA Systems Weblogic Server 7.0 SP7
  • BEA Systems Weblogic Server 8.1
  • BEA Systems Weblogic Server 8.1.0
  • BEA Systems Weblogic Server 8.1.0 SP 1
  • BEA Systems Weblogic Server 8.1.0 SP 2
  • BEA Systems Weblogic Server 8.1.0 SP 3
  • BEA Systems Weblogic Server 8.1.0 SP 4
  • BEA Systems Weblogic Server 8.1.0 SP 5
  • BEA Systems Weblogic Server 8.1.0 SP 6
  • BEA Systems Weblogic Server 9.0
  • BEA Systems Weblogic Server 9.1
  • BEA Systems Weblogic Server 9.2
  • BEA Systems Weblogic Server 9.2 Maintenance Pack 3
  • Oracle Collaboration Suite Release 1 10.1.2
  • Oracle E-Business Suite 11i 11.5.10.2
  • Oracle E-Business Suite 12 12.0.6
  • Oracle Enterprise Manager Grid Control 10g 10.2.0.4
  • Oracle Oracle10g Application Server 10.1.2 .2.0
  • Oracle Oracle10g Application Server 10.1.2.3.0
  • Oracle Oracle10g Application Server 10.1.3 .3.0
  • Oracle Oracle10g Enterprise Edition 10.1.0 .5
  • Oracle Oracle10g Enterprise Edition 10.2.0 .2
  • Oracle Oracle10g Enterprise Edition 10.2.0.2 64 bit
  • Oracle Oracle10g Enterprise Edition 10.2.0 .3
  • Oracle Oracle10g Enterprise Edition 10.2.0.4
  • Oracle Oracle10g Personal Edition 10.1.0.5
  • Oracle Oracle10g Personal Edition 10.2.0 .2
  • Oracle Oracle10g Personal Edition 10.2.0 .3
  • Oracle Oracle10g Personal Edition 10.2.0.4
  • Oracle Oracle10g Standard Edition 10.1.0 .5
  • Oracle Oracle10g Standard Edition 10.2.0 .2
  • Oracle Oracle10g Standard Edition 10.2.0 .3
  • Oracle Oracle10g Standard Edition 10.2.0.4
  • Oracle Oracle11g Enterprise Edition 11.1.0 6
  • Oracle Oracle11g Standard Edition 11.1.0 6
  • Oracle Oracle11g Standard Edition One 11.1.0 6
  • Oracle Oracle9i Enterprise Edition 9.2.0.8.0
  • Oracle Oracle9i Enterprise Edition 9.2.0 .8DV
  • Oracle Oracle9i Personal Edition 9.2.0 .8
  • Oracle Oracle9i Personal Edition 9.2.0 .8DV
  • Oracle Oracle9i Standard Edition 9.2.0.8
  • Oracle Oracle9i Standard Edition 9.2.0 .8DV
  • Oracle Secure Backup 10.1.0.1
  • Oracle Secure Backup 10.1.0.2
  • Oracle Secure Backup 10.1.0.3
  • Oracle Secure Backup 10.2.0.2
  • Oracle Secure Backup 10.2.0.3
  • Oracle TimesTen In-Memory Database 7.0.5.1.0
  • Oracle TimesTen In-Memory Database 7.0.5.2.0
  • Oracle TimesTen In-Memory Database 7.0.5.3.0
  • Oracle TimesTen In-Memory Database 7.0.5.4.0

References

  • BugTraq: 33177
  • CVE: CVE-2008-4006

Site Map
RSS Feeds
Careers
Accessibility
Feedback
Privacy & Policy
Legal Notices
Copyright© 1999-2010 Juniper Networks, Inc. All rights reserved.
Help
|
My Account
|
Log Out