vendor:
Oracle VM Server
by:
jduck
7.5
CVSS
HIGH
Command Injection
78
CWE
Product Name: Oracle VM Server
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE: CVE-2010-3585
CPE: Unknown
Platforms Tested: Unix, Linux
2010
Oracle VM Server Virtual Server Agent Command Injection
This module exploits a command injection flaw within Oracle's VM Server Virtual Server Agent (ovs-agent) service. By including shell meta characters within the second parameter to the 'utl_test_url' XML-RPC methodCall, an attacker can execute arbitrary commands. The service typically runs with root privileges. NOTE: Valid credentials are required to trigger this vulnerable. The username appears to be hardcoded as 'oracle', but the password is set by the administrator at installation time.
Mitigation:
Unknown