CVE-2010-4423

Related Files

OracleRemExecService Command Execution

Posted Jan 21, 2011

Authored by Martin Rakhmanov | Site appsecinc.com

Team SHATTER Security Advisory - It is possible to execute arbitrary operating system commands as localsystem when certain maintenance tasks are executed. For instance, when Database Configuration Assistant is invoked or Oracle Universal Installer is used to modify features. These tools use a Windows service to execute various commands: the service itself relies on a named pipe to receive the commands. The pipe handling is not secure enough resulting in the vulnerability.

tags | advisory, arbitrary

systems | windows

advisories | CVE-2010-4423

SHA-256 | 917ec70d2616d1daa738ea18642a5db3ecb8441d150203729a61d9b856e59d94

Download | Favorite | View