Critical flaw found in Oracle developer tool Staff

Oracle JInitiator contains a critical flaw that could be exploited by an attacker to execute arbitrary code and compromise a vulnerable system.

The tool is used by developers to run Oracle Developer Server applications directly within Internet Explorer. The flaw was discovered in versions and earlier.

The vulnerability was discovered by Will Dormann of the United States Computer Emergency Readiness Team (US-CERT).

    Requires Free Membership to View

In the US-CERT advisory, Dormann said the Oracle JInitiator ActiveX control contains multiple stack buffer overflows, which could allow a hacker to conduct an attack remotely. The attacker must trick a user into visiting a malicious website, to conduct the attack.

A patch has not been released. As a workaround, Dormann advised users to disable the Oracle JInitiator ActiveX control in Internet Explorer.

"Installing a later version of the software will not remove the vulnerable version of the control," Dormann said in the advisory. "We are currently unaware of a practical solution to this problem."

Danish security firm Secunia rated the vulnerability "highly critical" in its advisory to customers.

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: