Zero Day Initiative Advisory 11-020 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Beehive. Authentication is not required to exploit this vulnerability. The specific flaw exists within 'voice-servlet/prompt-qa/Index.jspf'. During the creation of a file used for storing an evaluation parameter user supplied data is used to create a filename and another user specified field is later used to populate that file's contents. By inserting a null byte (0x00) into the filename the user can control the extension of the newly created file. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the oracle user.
8695d5670ace9b02fa453ba397c1729eeee23fac2228b9e55c71ce2e694e72a1
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed