search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Oracle Outside In contains exploitable vulnerabilities in Lotus 123 and Microsoft CAB file parsers

Vulnerability Note VU#520721

Original Release Date: 2011-04-19 | Last Revised: 2014-04-28

Overview

Oracle Outside In contains exploitable vulnerabilities in Lotus 123 and Microsoft CAB file parsers, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Oracle Outside In is a set of libraries that can decode over 500 different file formats. Originally written by Stellent, Outside In is now part of Oracle. The Oracle Outside In libraries are used by a variety of applications, including Oracle Fusion Middleware, Google Search Appliance, Guidance Encase Forensics, AccessData FTK, and Novell Groupwise.

Outside In fails to properly handle Lotus 123 and Microsoft CAB file data, which are handled on the Windows platform by the libraries vswk6.dll and sccut.dll, respectively. The Linux version of Outside In uses libvs_wk6.so and libsc_ut.so. Other supported platforms may use different file names.The CAB file parser may be used when handling a variety of file formats, including Microsoft OneNote (.onepkg).

Limited testing has shown that the Lotus 123 parser in Outside In versions 8.1.0.4037 through 8.3.5.5684 are vulnerable. Previous versions may also be affected. The CAB file identification vulnerability appears to only affect 8.3.5.x versions through 8.3.5.5684.

Impact

By causing an application to process a specially-crafted file with the Oracle Outside In library, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the vulnerable application. Depending on what application is using Outside In, this may happen as the result of some user interaction, such as single-clicking on a file, or it may happen with no user interaction at all.

Solution

Apply an update

These vulnerabilites are addressed in the Oracle Fusion Middleware Critical Patch Update April 2011. This update provides updated libraries with versions 8.3.5.5927 and 8.3.2.5927, for the Outside in 8.3.5 and 8.3.2 product lines, respectively. Please see Oracle Support Note 1291877.1 (valid Oracle CSI# required) for more details. If you are using an application that uses Outside In, please check with that application's vendor for updates. If updates for your application are not yet available, or if you wish to mitigate other vulnerabilities in Outside In, please consider the following workarounds:

Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this and other vulnerabilities.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information

520721
 
Expand all

ACD Systems International Affected

Updated:  July 06, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown ACD Systems Canvas 14 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

AccessData Affected

Notified:  March 30, 2011 Updated: August 03, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Limited testing has shown FTK 3.2 and 3.3 to be vulnerable. Other versions may also be affected. FTK 3.3.1 has been released to address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Avantstar Affected

Updated:  April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Quick View Plus 11 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cisco Systems, Inc. Affected

Notified:  April 18, 2011 Updated: January 16, 2012

Status

Affected

Vendor Statement

Cisco Security Agent is affected by vulnerabilities that could allow an
unauthenticated attacker to perform remote code execution on the affected
device. These vulnerabilities are in a third-party library (Oracle Outside In)
and are documented in CERT-CC Vulnerability Note VU#520721 at
http://www.kb.cert.org/vuls/id/520721

Cisco has released free software updates that address these vulnerabilities.

No workaround is available to mitigate these vulnerabilities.
This advisory is posted at
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Cisco Security Agent uses Oracle Outside In to provide Data Loss Prevention (DLP) functionality.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Google Affected

Updated:  April 01, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Google Search Appliance (GSA) uses Outside In. Google has indicated that they update Outside In when appropriate, but they have not indicated which GSA version may address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Guidance Software, Inc. Affected

Notified:  April 18, 2011 Updated: July 25, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Guidance Encase Forensics 6.16.1.4 and 7.01 to be vulnerable. Other Encase products and versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company Affected

Notified:  April 19, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

HP TRIM uses the Oracle Outside In libraries

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM Corporation Affected

Notified:  April 18, 2011 Updated: January 29, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Many IBM ECM products use Oracle Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Kamel Software Affected

Notified:  April 18, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Kamel Fastlook 2009 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Kroll Ontrack Inc Affected

Notified:  April 21, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Kroll Ontrack software, such as Ontrack EasyRecovery and PowerControls, uses Outside In to provide file viewing capabilities.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lucion Affected

Notified:  July 22, 2011 Updated: August 26, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Limited testing has shown Lucion FileCenter 7 to be vulnerable. Other versions may also be affected.

FileCenter 7.1.0.35 provides Outside In version 8.3.7, which contains fixes for this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

MarkLogic Corporation Affected

Notified:  August 08, 2011 Updated: August 26, 2011

Status

Affected

Vendor Statement

MarkLogic Corporation acknowledges CERT Vulnerability Notes VU#103425 and
VU#520721 and confirms that an affected version of Oracle Outside In is bundled
and shipped with MarkLogic Server versions 4.0, 4.1 and 4.2.  Outside In file
conversion is a keyed option in MarkLogic Server.  The Outside In converters
cannot be accessed from within the MarkLogic Server programming environment
without an installed license key that enables the Outside In conversion
option.  The Outside In conversion option for MarkLogic Server has not been
advertised and circulation is highly restricted.  Therefore, the security risk
imposed by the bundled Outside In utility on the MarkLogic user community is
extremely limited.

Regardless, the affected Outside In libraries have been removed from MarkLogic
Server 4.1 (4.1-11) and 4.2 (4.2-6) and will be absent in all future
maintenance releases for those codelines.  Further, Outside In will be removed
entirely from upcoming MarkLogic Server version 5.0.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

McAfee Affected

Notified:  April 21, 2011 Updated: May 04, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

McAfee GroupShield as well as Host Data Loss Prevention 9.0 and earlier use Outside In to provide file content filtering capabilities. Limited testing has shown GroupShield 7.0.716.101 to be vulnerable, resulting in code execution with SYSTEM privileges. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NewSoft America Inc Affected

Notified:  April 21, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Presto! PageManager 9 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Novell, Inc. Affected

Notified:  April 18, 2011 Updated: September 26, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Novell Groupwise uses Outside In for viewing email attachments and is affected. This issue is addressed by GroupWise 8.0 Hot Patch 3 (HP3).

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Oracle Corporation Affected

Notified:  March 04, 2011 Updated: April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Paraben Corporation Affected

Notified:  July 22, 2011 Updated: January 16, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Paraben Device Seizure 4.3 to be vulnerable. Other versions may also be affected. Paraben has stopped using Outside In starting with version 4.5 build 4262.38310, and is therefore not affected with this and later versions.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Perlustro Affected

Notified:  August 10, 2011 Updated: August 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Perlustro ILook uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Raytheon Affected

Updated:  April 28, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Raytheon SureView uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Stellent Affected

Updated:  April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Symantec Affected

Notified:  August 05, 2011 Updated: September 01, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Symantec Enterprise Vault uses Oracle Outside In. Updates have been provided for Enterprise Vault versions 8.0 SP5 through 10.0. Please see Symantec Advisory SYM11-011 for more details.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Windream gmbh Affected

Notified:  June 02, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

windream server uses the Outside In libraries.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

X1 Technologies Inc. Affected

Notified:  April 18, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown X1 Professional 6.7.2 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

kcura Affected

Updated:  August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

kCura Relativity uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Dell Computer Corporation, Inc. Unknown

Notified:  April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Dell printer software provides files from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Good Technology Unknown

Updated:  April 20, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Good Technology Mobile Messaging Server uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lexmark International Unknown

Notified:  April 21, 2011 Updated: May 10, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Lexmark printer software provides components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Microsoft Corporation Unknown

Notified:  April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Microsoft Exchange and Hummingbird DM provide components from Outside In, but it is not clear if they are affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Motorola, Inc. Unknown

Notified:  April 20, 2011 Updated: April 20, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sharp Electronics Corporation Unknown

Notified:  April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Sharp Sharpdesk provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sun Microsystems, Inc. Unknown

Notified:  April 21, 2011 Updated: April 21, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Westlaw Unknown

Updated:  April 19, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

West Publisher E-Transcript Bundle Viewer provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

View all 32 vendors View less vendors


CVSS Metrics

Group Score Vector
Base 9 AV:N/AC:M/Au:N/C:C/I:C/A:P
Temporal 7 E:POC/RL:OF/RC:C
Environmental 7.1 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Acknowledgements

These vulnerabilities were reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2011-0794, CVE-2011-0808
Severity Metric: 17.71
Date Public: 2011-04-19
Date First Published: 2011-04-19
Date Last Updated: 2014-04-28 18:29 UTC
Document Revision: 78

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis