CVE-2010-3585
Oracle VM Server Virtual Server Agent Command Injection
Title source: metasploitExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3585.
PoCs published by Metasploit, jduck, including Metasploit module exploits/unix/webapp/oracle_vm_agent_utl.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Oracle VM Server's Virtual Server Agent (ovs-agent) via the 'utl_test_url' XML-RPC method. It allows arbitrary command execution with root privileges by injecting shell meta characters into the second parameter.
Description
Unspecified vulnerability in the OracleVM component in Oracle VM 2.2.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ovs-agent. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a third party researcher that this is related to the exposure of unspecified functions using XML-RPC.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in Oracle VM Server's Virtual Server Agent (ovs-agent) via the 'utl_test_url' XML-RPC method. It allows arbitrary command execution with root privileges by injecting shell meta characters into the second parameter.
This Metasploit module exploits a command injection vulnerability in Oracle VM Server's Virtual Server Agent (ovs-agent) via the 'utl_test_url' XML-RPC method. It allows arbitrary command execution with root privileges by injecting shell meta characters into the second parameter of the method call.