Oracle GoldenGate Manager < 12.2.0.1.1 OBEY Command ggserr.log File Handling RCE

critical Nessus Plugin ID 100620

Language:

Synopsis

The Oracle GoldenGate Manager application running on the remote host is affected by a remote code execution vulnerability.

Description

According to its self-reported version number, the Oracle GoldenGate Manager application running on the remote host is prior to 12.2.0.1.1.
It is, therefore, affected by a remote code execution vulnerability due to improper handling of 'OBEY' commands and the ggserr.log file.
An unauthenticated, remote attacker can exploit this to execute arbitrary code by entering a 'SHELL' command into the error log and then executing the error log via the 'OBEY' command.

Note that newer versions of Oracle GoldenGate Manager do not fix this issue but instead introduce access controls that disallow use of 'OBEY' by default.

Solution

Upgrade to Oracle GoldenGate Manager version 12.2.0.1.1 and use appropriate access controls to disallow the use of the 'OBEY' command.

Plugin Details

Severity: Critical

ID: 100620

File Name: golden_gate_err_log_execution.nasl

Version: 1.6

Type: remote

Family: Misc.

Published: 6/5/2017

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:oracle:goldengate

Required KB Items: gg_manager/present

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/8/2017

Detections

Analytics