[ERPSCAN-11-006] Oracle Document Capture ActiveX — Insecure method, buffer overflow

DSECRG Advisories

Application: Oracle Document Capture
Versions Affected: Oracle Document Capture
Vendor URL: http://oracle.com
Bugs: Insecure method. Buffer overflow.
Exploits: YES
Reported: 14.12.2009
Vendor response: 15.12.2009
Date of Public Advisory: 24.01.2011
CVE-number: CVE-2010-3599
Author: Alexandr Polyakov

Insecure method was founded in NCSECWLib ActiveX control component which is a part of Oracle Document Capture. One of the methods (WriteJPG) can be used to owervrite files on users system and also affected to buffer overflow.

Business Risk
An attacker can send a malicious link to an unaware user via an e-mail, messaging or social networks. He also can insert this link into corporate portal. When clicking this link the end user browser will call vulnerable ActiveX component which can delete any file on victim’s workstation. It is possible to delete configuration files of critical binaries that can lead to denial of service attack and stopping business until files will be repaired. This scenario is critical if user works with SAP for Logistics or SAP for Banking applications.