CVE-2010-3600

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 77%

from disclosure to weapon666 days

Published on NVDJan 19

1st PoC+666d

metasploitJan 18

exploitation probability

77%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.

Affected products

n/a · n/a

public PoCs found — 2

githubgithub.com/LAITRUNGMINHDUC/CVE-2010-3600-PythonHackOracle11gR2★ 2 exploitdbwww.exploit-db.com/exploits/22714unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/42895 http://secunia.com/advisories/42921 https://exchange.xforce.ibmcloud.com/vulnerabilities/64755 http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html http://www.securityfocus.com/bid/45883 http://www.securitytracker.com/id?1024972 http://www.vupen.com/english/advisories/2011/0139 http://www.vupen.com/english/advisories/2011/0140 http://www.zerodayinitiative.com/advisories/ZDI-11-018/