ID CVE-2013-5791
Summary Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is a stack-based buffer overflow in the Microsoft Access 1.x parser in vsacs.dll before 8.4.0.108 and before 8.4.1.52, which allows attackers to execute arbitrary code via a long field (aka column) name. Per http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8.'
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:fusion_middleware:8.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:fusion_middleware:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:fusion_middleware:8.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:fusion_middleware:8.4.1:*:*:*:*:*:*:*
CVSS
Base: 1.5 (as of 12-10-2018 - 22:05)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM SINGLE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:L/AC:M/Au:S/C:N/I:N/A:P
msbulletin via4
bulletin_id MS13-105
bulletin_url
date 2013-12-10T00:00:00
impact Remote Code Execution
knowledgebase_id 2915705
knowledgebase_url
severity Critical
title Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution
refmap via4
bid 63076
cert-vn VU#953241
confirm
exploit-db 31222
misc http://www.citadelo.com/en/ms13-105-oracle-outside-in-mdb-parsing-vulnerability-cve-2013-5791/
sectrack 1029190
secunia
  • 56237
  • 56241
  • 56243
Last major update 12-10-2018 - 22:05
Published 16-10-2013 - 15:55
Last modified 12-10-2018 - 22:05
Back to Top