A vulnerability has been identified in Oracle Document Capture, which could be exploited by remote attackers to compromise an affected system. This issue is caused by a design error in the "blackicedevmode.ocx" ActiveX control when processing arguments supplied via the "SetApplicationPath()" and "SetCustomStartAppParameter()" methods, which could be exploited to inject arbitrary commands by tricking a user into visiting a malicious web page.

Affected Products

Oracle Document Capture 10g version 10.1.3.5.0 and prior

Solution

Set a kill bit for the CLSID {1503569A-0AE2-4333-B6E6-466AB0BC73E5}.

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/2796
http://retrogod.altervista.org/9sg_oracle_devmode_ii.html

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Credits

Vulnerability reported by Nine:Situations:Group::pyrokinesis.

Changelog

2009-09-30 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.