search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Oracle Outside In CorelDRAW file parser stack buffer overflow

Vulnerability Note VU#103425

Original Release Date: 2011-07-19 | Last Revised: 2014-04-28

Overview

Oracle Outside In contains a stack buffer overflow in the CorelDRAW parser, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Oracle Outside In is a set of libraries that can decode over 500 different file formats. Originally written by Stellent, Outside In is now part of Oracle. The Oracle Outside In libraries are used by a variety of applications, including Oracle Fusion Middleware, Google Search Appliance, Guidance Encase Forensics, AccessData FTK, and Novell Groupwise.

Outside In versions 8.3.5.5927 and 8.3.2.5927 and earlier fail to properly handle CorelDRAW data, which is handled by the imcdr2.flt library.

Impact

By causing an application to process a specially-crafted .CDR file with the Oracle Outside In library, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the vulnerable application. Depending on what application is using Outside In, this may happen as the result of some user interaction, such as single-clicking on a file, or it may happen with no user interaction at all.

Solution

Apply an update

These vulnerabilites are addressed in the Oracle Fusion Middleware Critical Patch Update July 2011. Please see Oracle Support Note 1323616.1 (valid Oracle CSI# required) for more details. If you are using an application that uses Outside In, please check with that application's vendor for updates. If updates for your application are not yet available, or if you wish to mitigate other vulnerabilities in Outside In, please consider the following workarounds:

Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this and other vulnerabilities.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information

103425
Expand all

ACD Systems International

Updated:  July 06, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown ACD Systems Canvas 14 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

AccessData

Notified:  March 30, 2011 Updated:  August 03, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://ftk.accessdata.com/ http://accessdata.com/downloads/current_releases/ftk/FTK_3-3-x_patch_for_Secunia_Advisory_SA45219.exe

Addendum

Limited testing has shown FTK 3.2 and 3.3 to be vulnerable. Other versions may also be affected. FTK 3.3.1 has been released to address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Avantstar

Updated:  April 19, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Quick View Plus 11 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cisco Systems, Inc.

Notified:  April 18, 2011 Updated:  October 27, 2011

Status

  Affected

Vendor Statement

Cisco Security Agent is affected by vulnerabilities that could allow an
unauthenticated attacker to perform remote code execution on the affected
device. These vulnerabilities are in a third-party library (Oracle Outside In)
and are documented in CERT-CC Vulnerability Note VU#520721 at
http://www.kb.cert.org/vuls/id/520721

Cisco has released free software updates that address these vulnerabilities.

No workaround is available to mitigate these vulnerabilities.
This advisory is posted at
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa

Addendum

Cisco Security Agent uses Oracle Outside In to provide Data Loss Prevention (DLP) functionality. Although the Cisco update only refers to VU#520721, it includes the updated CorelDRAW parser as well.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Google

Updated:  April 01, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Google Search Appliance (GSA) uses Outside In. Google has indicated that they update Outside In when appropriate, but they have not indicated which GSA version may address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Guidance Software, Inc.

Notified:  April 18, 2011 Updated:  July 25, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Guidance Encase Forensics 6.16.1.4 and 7.01 to be vulnerable. Other Encase products and versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company

Notified:  April 19, 2011 Updated:  May 10, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

HP TRIM uses the Oracle Outside In libraries

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM Corporation

Notified:  April 18, 2011 Updated:  January 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www-01.ibm.com/support/docview.wss?uid=swg21512725 http://www-01.ibm.com/support/docview.wss?uid=swg21574454

Kamel Software

Notified:  April 18, 2011 Updated:  August 08, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Kamel Fastlook 2009 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Kroll Ontrack Inc

Notified:  April 21, 2011 Updated:  May 10, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Kroll Ontrack software, such as Ontrack EasyRecovery and PowerControls, uses Outside In to provide file viewing capabilities.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lucion

Notified:  July 22, 2011 Updated:  August 26, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.lucion.com/files/FileCenterSetup7.exe

Addendum

Limited testing has shown Lucion FileCenter 7 to be vulnerable. Other versions may also be affected.

FileCenter 7.1.0.35 provides Outside In version 8.3.7, which contains fixes for this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

MarkLogic Corporation

Notified:  August 08, 2011 Updated:  August 26, 2011

Status

  Affected

Vendor Statement

MarkLogic Corporation acknowledges CERT Vulnerability Notes VU#103425 and
VU#520721 and confirms that an affected version of Oracle Outside In is bundled
and shipped with MarkLogic Server versions 4.0, 4.1 and 4.2.  Outside In file
conversion is a keyed option in MarkLogic Server.  The Outside In converters
cannot be accessed from within the MarkLogic Server programming environment
without an installed license key that enables the Outside In conversion
option.  The Outside In conversion option for MarkLogic Server has not been
advertised and circulation is highly restricted.  Therefore, the security risk
imposed by the bundled Outside In utility on the MarkLogic user community is
extremely limited.

Regardless, the affected Outside In libraries have been removed from MarkLogic
Server 4.1 (4.1-11) and 4.2 (4.2-6) and will be absent in all future
maintenance releases for those codelines.  Further, Outside In will be removed
entirely from upcoming MarkLogic Server version 5.0.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

McAfee

Notified:  April 21, 2011 Updated:  May 04, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://kc.mcafee.com/corporate/index?page=content&id=KB59754

Addendum

McAfee GroupShield as well as Host Data Loss Prevention 9.0 and earlier use Outside In to provide file content filtering capabilities. Limited testing has shown GroupShield 7.0.716.101 to be vulnerable, resulting in code execution with SYSTEM privileges. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NewSoft America Inc

Notified:  April 21, 2011 Updated:  May 10, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Presto! PageManager 9 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Novell, Inc.

Notified:  April 18, 2011 Updated:  September 26, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=7009213&sliceId=1&docTypeID=DT_TID_1_1 http://download.novell.com/Download?buildid=rl1M_rWE028~

Addendum

Novell Groupwise uses Outside In for viewing email attachments and is affected. This issue is addressed by GroupWise 8.0 Hot Patch 3 (HP3).

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Oracle Corporation

Notified:  March 04, 2011 Updated:  July 19, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1323616.1

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Paraben Corporation

Notified:  July 22, 2011 Updated:  August 08, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown Paraben Device Seizure 4.3 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Perlustro

Notified:  August 10, 2011 Updated:  August 10, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.perlustro.com/solutions/e-forensics/ilook-pi http://www.perlustro.com/press-releases/oracle-viewing-technology

Addendum

Perlustro ILook uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Raytheon

Updated:  April 28, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Raytheon SureView uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Stellent

Updated:  April 19, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Symantec

Notified:  August 05, 2011 Updated:  September 01, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110901_00 http://www.symantec.com/business/support/index?page=content&id=TECH167455

Addendum

Symantec Enterprise Vault uses Oracle Outside In. Updates have been provided for Enterprise Vault versions 8.0 SP5 through 10.0. Please see Symantec Advisory SYM11-011 for more details.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Windream gmbh

Notified:  June 02, 2011 Updated:  August 08, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

windream server uses the Outside In libraries.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

X1 Technologies Inc.

Notified:  April 18, 2011 Updated:  August 08, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Limited testing has shown X1 Professional 6.7.2 to be vulnerable. Other versions may also be affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

kcura

Updated:  August 08, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://kcura.com/relativity http://kcura.com/relativity/partners/technology-partners

Addendum

kCura Relativity uses the Oracle Outside In library.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Dell Computer Corporation, Inc.

Notified:  April 18, 2011 Updated:  April 18, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Dell printer software provides files from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Good Technology

Updated:  April 20, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Good Technology Mobile Messaging Server uses Outside In.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lexmark International

Notified:  April 21, 2011 Updated:  May 10, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Some Lexmark printer software provides components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Microsoft Corporation

Notified:  April 18, 2011 Updated:  April 18, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Microsoft Exchange and Hummingbird DM provide components from Outside In, but it is not clear if they are affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Motorola, Inc.

Notified:  April 20, 2011 Updated:  April 20, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sharp Electronics Corporation

Notified:  April 18, 2011 Updated:  April 18, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Sharp Sharpdesk provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sun Microsystems, Inc.

Notified:  April 21, 2011 Updated:  April 21, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Westlaw

Updated:  April 19, 2011

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

West Publisher E-Transcript Bundle Viewer provides some components from Outside In, but it is not clear if it is affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 9.0 AV:N/AC:M/Au:N/C:C/I:C/A:P
Temporal 7.0 E:POC/RL:OF/RC:C
Environmental 7.1 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Credit

These vulnerabilities were reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2011-2264
Severity Metric: 17.71
Date Public: 2011-07-19
Date First Published: 2011-07-19
Date Last Updated: 2014-04-28 18:28 UTC
Document Revision: 97

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.