Oracle Outside In contains exploitable vulnerabilities in Lotus 123 and Microsoft CAB file parsers

Overview

Oracle Outside In contains exploitable vulnerabilities in Lotus 123 and Microsoft CAB file parsers, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Oracle Outside In is a set of libraries that can decode over 500 different file formats. Originally written by Stellent, Outside In is now part of Oracle. The Oracle Outside In libraries are used by a variety of applications, including Oracle Fusion Middleware, Google Search Appliance, Guidance Encase Forensics, AccessData FTK, and Novell Groupwise.

Outside In fails to properly handle Lotus 123 and Microsoft CAB file data, which are handled on the Windows platform by the libraries vswk6.dll and sccut.dll, respectively. The Linux version of Outside In uses libvs_wk6.so and libsc_ut.so. Other supported platforms may use different file names.The CAB file parser may be used when handling a variety of file formats, including Microsoft OneNote (.onepkg).

Limited testing has shown that the Lotus 123 parser in Outside In versions 8.1.0.4037 through 8.3.5.5684 are vulnerable. Previous versions may also be affected. The CAB file identification vulnerability appears to only affect 8.3.5.x versions through 8.3.5.5684.

---

Impact

By causing an application to process a specially-crafted file with the Oracle Outside In library, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the vulnerable application. Depending on what application is using Outside In, this may happen as the result of some user interaction, such as single-clicking on a file, or it may happen with no user interaction at all.

---

Solution

Apply an update

These vulnerabilites are addressed in the Oracle Fusion Middleware Critical Patch Update April 2011. This update provides updated libraries with versions 8.3.5.5927 and 8.3.2.5927, for the Outside in 8.3.5 and 8.3.2 product lines, respectively. Please see Oracle Support Note 1291877.1 (valid Oracle CSI# required) for more details. If you are using an application that uses Outside In, please check with that application’s vendor for updates. If updates for your application are not yet available, or if you wish to mitigate other vulnerabilities in Outside In, please consider the following workarounds:

---

Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this and other vulnerabilities.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

---

Vendor Information

520721

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

ACD Systems International __ Affected

Updated: July 06, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown ACD Systems Canvas 14 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

AccessData __ Affected

Notified: March 30, 2011 Updated: August 03, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://ftk.accessdata.com/&gt;
• <http://accessdata.com/downloads/current_releases/ftk/FTK_3-3-x_patch_for_Secunia_Advisory_SA45219.exe&gt;

Addendum

Limited testing has shown FTK 3.2 and 3.3 to be vulnerable. Other versions may also be affected. FTK 3.3.1 has been released to address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Avantstar __ Affected

Updated: April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Quick View Plus 11 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Cisco Systems, Inc. __ Affected

Notified: April 18, 2011 Updated: January 16, 2012

Status

Affected

Vendor Statement

Cisco Security Agent is affected by vulnerabilities that could allow an unauthenticated attacker to perform remote code execution on the affected device. These vulnerabilities are in a third-party library (Oracle Outside In) and are documented in CERT-CC Vulnerability Note VU#520721 at http://www.kb.cert.org/vuls/id/520721`

Cisco has released free software updates that address these vulnerabilities.

No workaround is available to mitigate these vulnerabilities.
This advisory is posted at
[http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa`](<http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa&gt;).

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa&gt;

Addendum

Cisco Security Agent uses Oracle Outside In to provide Data Loss Prevention (DLP) functionality.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Google __ Affected

Updated: April 01, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Google Search Appliance (GSA) uses Outside In. Google has indicated that they update Outside In when appropriate, but they have not indicated which GSA version may address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Guidance Software, Inc. __ Affected

Notified: April 18, 2011 Updated: July 25, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Guidance Encase Forensics 6.16.1.4 and 7.01 to be vulnerable. Other Encase products and versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Hewlett-Packard Company __ Affected

Notified: April 19, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

HP TRIM uses the Oracle Outside In libraries

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

IBM Corporation __ Affected

Notified: April 18, 2011 Updated: January 29, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www-01.ibm.com/support/docview.wss?uid=swg21574454&gt;

Addendum

Many IBM ECM products use Oracle Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Kamel Software __ Affected

Notified: April 18, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Kamel Fastlook 2009 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Kroll Ontrack Inc __ Affected

Notified: April 21, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Kroll Ontrack software, such as Ontrack EasyRecovery and PowerControls, uses Outside In to provide file viewing capabilities.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Lucion __ Affected

Notified: July 22, 2011 Updated: August 26, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.lucion.com/files/FileCenterSetup7.exe&gt;

Addendum

Limited testing has shown Lucion FileCenter 7 to be vulnerable. Other versions may also be affected.

FileCenter 7.1.0.35 provides Outside In version 8.3.7, which contains fixes for this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

MarkLogic Corporation __ Affected

Notified: August 08, 2011 Updated: August 26, 2011

Status

Affected

Vendor Statement

`MarkLogic Corporation acknowledges CERT Vulnerability Notes VU#103425 and
VU#520721 and confirms that an affected version of Oracle Outside In is bundled
and shipped with MarkLogic Server versions 4.0, 4.1 and 4.2. Outside In file
conversion is a keyed option in MarkLogic Server. The Outside In converters
cannot be accessed from within the MarkLogic Server programming environment
without an installed license key that enables the Outside In conversion
option. The Outside In conversion option for MarkLogic Server has not been
advertised and circulation is highly restricted. Therefore, the security risk
imposed by the bundled Outside In utility on the MarkLogic user community is
extremely limited.

Regardless, the affected Outside In libraries have been removed from MarkLogic
Server 4.1 (4.1-11) and 4.2 (4.2-6) and will be absent in all future
maintenance releases for those codelines. Further, Outside In will be removed
entirely from upcoming MarkLogic Server version 5.0.`

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

McAfee __ Affected

Notified: April 21, 2011 Updated: May 04, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• https://kc.mcafee.com/corporate/index?page=content&id=KB59754

Addendum

McAfee GroupShield as well as Host Data Loss Prevention 9.0 and earlier use Outside In to provide file content filtering capabilities. Limited testing has shown GroupShield 7.0.716.101 to be vulnerable, resulting in code execution with SYSTEM privileges. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

NewSoft America Inc __ Affected

Notified: April 21, 2011 Updated: May 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Presto! PageManager 9 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Novell, Inc. __ Affected

Notified: April 18, 2011 Updated: September 26, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• [http://www.novell.com/support/search.do?cmd=displayKC&amp;docType=kc&amp;externalId=7009213&amp;sliceId=1&amp;docTypeID=DT_TID_1_1 ](<http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=7009213&sliceId=1&docTypeID=DT_TID_1_1
  >)
• <http://download.novell.com/Download?buildid=rl1M_rWE028~&gt;

Addendum

Novell Groupwise uses Outside In for viewing email attachments and is affected. This issue is addressed by GroupWise 8.0 Hot Patch 3 (HP3).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Oracle Corporation Affected

Notified: March 04, 2011 Updated: April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html&gt;

Paraben Corporation __ Affected

Notified: July 22, 2011 Updated: January 16, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Paraben Device Seizure 4.3 to be vulnerable. Other versions may also be affected. Paraben has stopped using Outside In starting with version 4.5 build 4262.38310, and is therefore not affected with this and later versions.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Perlustro __ Affected

Notified: August 10, 2011 Updated: August 10, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.perlustro.com/solutions/e-forensics/ilook-pi&gt;
• <http://www.perlustro.com/press-releases/oracle-viewing-technology&gt;

Addendum

Perlustro ILook uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Raytheon __ Affected

Updated: April 28, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Raytheon SureView uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Stellent Affected

Updated: April 19, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Symantec __ Affected

Notified: August 05, 2011 Updated: September 01, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• [http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=2011&amp;suid=20110901_00 ](<http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110901_00
  >)
• http://www.symantec.com/business/support/index?page=content&id=TECH167455

Addendum

Symantec Enterprise Vault uses Oracle Outside In. Updates have been provided for Enterprise Vault versions 8.0 SP5 through 10.0. Please see Symantec Advisory SYM11-011 for more details.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Windream gmbh __ Affected

Notified: June 02, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

windream server uses the Outside In libraries.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

X1 Technologies Inc. __ Affected

Notified: April 18, 2011 Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown X1 Professional 6.7.2 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

kcura __ Affected

Updated: August 08, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://kcura.com/relativity&gt;
• <http://kcura.com/relativity/partners/technology-partners&gt;

Addendum

kCura Relativity uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Dell Computer Corporation, Inc. __ Unknown

Notified: April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Dell printer software provides files from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Good Technology __ Unknown

Updated: April 20, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Good Technology Mobile Messaging Server uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Lexmark International __ Unknown

Notified: April 21, 2011 Updated: May 10, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Lexmark printer software provides components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Microsoft Corporation __ Unknown

Notified: April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Microsoft Exchange and Hummingbird DM provide components from Outside In, but it is not clear if they are affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Motorola, Inc. Unknown

Notified: April 20, 2011 Updated: April 20, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sharp Electronics Corporation __ Unknown

Notified: April 18, 2011 Updated: April 18, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Sharp Sharpdesk provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

Sun Microsystems, Inc. Unknown

Notified: April 21, 2011 Updated: April 21, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Westlaw __ Unknown

Updated: April 19, 2011

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

West Publisher E-Transcript Bundle Viewer provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23520721 Feedback>).

View all 32 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	9	AV:N/AC:M/Au:N/C:C/I:C/A:P
Temporal	7	E:POC/RL:OF/RC:C
Environmental	7.1	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

• <http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html&gt;
• http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1291877.1
• <http://www.oracle.com/us/technologies/embedded/025613.htm&gt;
• <http://www.oracle.com/us/corporate/Acquisitions/stellent/index.html&gt;
• <http://blogs.technet.com/b/srd/archive/2010/12/08/on-the-effectiveness-of-dep-and-aslr.aspx&gt;
• <http://www.securityfocus.com/bid/47435&gt;
• <http://www.securityfocus.com/bid/47437&gt;
• <http://secunia.com/advisories/44295&gt;

Acknowledgements

These vulnerabilities were reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2011-0794, CVE-2011-0808
Severity Metric:	17.71 Date Public: