Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Forms | Oracle | 3.0 (including) | 3.0 (including) |
| Forms | Oracle | 4.5 (including) | 4.5 (including) |
| Forms | Oracle | 5.0 (including) | 5.0 (including) |
| Forms | Oracle | 6.0 (including) | 6.0 (including) |
| Forms | Oracle | 6i (including) | 6i (including) |
| Forms | Oracle | 9i (including) | 9i (including) |
| Forms | Oracle | 10g (including) | 10g (including) |
References
- http://marc.info/?l=bugtraq\u0026m=112180805413784\u0026w=2
- http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html
- http://marc.info/?l=bugtraq\u0026m=112180805413784\u0026w=2
- http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html