__________________________________________________________
	
						   The U.S. Department of Energy
					   Computer Incident Advisory Capability
							   ___  __ __    _     ___
							  /       |     /_\   /
							  \___  __|__  /   \  \___
				 __________________________________________________________
	
								 INFORMATION BULLETIN
	
						   Oracle JInitiator Vulnerabilities
						   [US-CERT Vulnerability VU#474433]
	
	August 29, 2007 18:00 GMT                                         Number R-334
	______________________________________________________________________________
	PROBLEM:       The Oracle JInitiator ActiveX control contains multiple stack 
				   buffer overflows, which could allow a remote, unauthenticated 
				   attacker to execute arbitrary code on a vulnerable system. 
	PLATFORM:      Oracle JInitiator versions 1.1.8.16 and earlier 
	DAMAGE:        Could allow a remote, unauthenticated attacker to execute 
				   arbitrary code on a vulnerable system. 
	SOLUTION:      There is currently no practical solution to this problem. 
				   Please consider the workarounds in the bulletin below. 
	______________________________________________________________________________
	VULNERABILITY  The risk is MEDIUM. Could allow a remote, unauthenticated 
	ASSESSMENT:    attacker to execute arbitrary code on a vulnerable system. 
	______________________________________________________________________________
	LINKS: 
	 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/r-334.shtml 
	 ORIGINAL BULLETIN:  http://www.kb.cert.org/vuls/id/474433 
	 CVE:                http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= 
						 CVE-2007-4467 
	______________________________________________________________________________
	[***** Start US-CERT Vulnerability VU#474433 *****]
	
	Vulnerability Note VU#474433
	Oracle JInitiator ActiveX control stack buffer overflows
	
	Overview
	
	The Oracle JInitiator ActiveX control contains multiple stack buffer overflows, 
	which could allow a remote, unauthenticated attacker to execute arbitrary code 
	on a vulnerable system. 
	
	I. Description
	Oracle JInitiator allows users to run Oracle Developer Server applications 
	within a web browser. Oracle JInitiator includes an ActiveX control called 
	beans.ocx. The Oracle JInitiator ActiveX control is vulnerable to multiple 
	stack buffer overflows in initialization parameters. 
	
	This vulnerability appears to be present in versions 1.1.8.16 and earlier of 
	the Oracle JInitiator software. However, installing a later version of the 
	software will not remove the vulnerable version of the control. 
	
	II. Impact
	A remote, unauthenticated attacker may be able to execute arbitrary code on a 
	vulnerable system with privileges of the user. 
	
	III. Solution
	We are currently unaware of a practical solution to this problem. Please 
	consider the following workarounds 
	
	Disable the Oracle JInitiator ActiveX control in Internet Explorer
	
	The vulnerable ActiveX control can be disabled in Internet Explorer by setting 
	the kill bit for the following CLSID:
	
	
	{9b935470-ad4a-11d5-b63e-00c04faedb18}
	
	More information about how to set the kill bit is available in Microsoft Support 
	Document 240797. Alternatively, the following text can be saved as a .REG file 
	and imported to set the kill bit for this control:
	
	Windows Registry Editor Version 5.00
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{9b935470-ad4a-11d5-b63e-00c04faedb18}]
	"Compatibility Flags"=dword:00000400
	Disable ActiveX
	
	Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) 
	appears to prevent exploitation of this and other ActiveX vulnerabilities. 
	Instructions for disabling ActiveX in the Internet Zone can be found in the 
	"Securing Your Web Browser" document.  
	
	Systems Affected
	Vendor Status Date Updated 
	Oracle Corporation Vulnerable 27-Aug-2007 
	
	References
	http://www.cert.org/tech_tips/securing_browser/#Internet_Explorer
	http://www.oracle.com/technology/software/products/developer/files/11816/readme.htm
	http://www.oracle.com/technology/software/products/developer/htdocs/jinit.htm
	http://www.securityfocus.com/bid/25473 
	
	Credit
	This vulnerability was reported by Will Dormann of the CERT/CC. 
	
	This document was written by Will Dormann. 
	
	Other Information
	Date Public 08/28/2007 
	Date First Published 08/28/2007 02:28:22 PM 
	Date Last Updated 08/28/2007 
	CERT Advisory   
	CVE Name CVE-2007-4467 
	Metric 2.29 
	Document Revision 9 
	
	
	[***** End US-CERT Vulnerability VU#474433 *****]
	_______________________________________________________________________________
	
	CIAC wishes to acknowledge the contributions of US-CERT for the 
	information contained in this bulletin.
	_______________________________________________________________________________
	
	
	CIAC, the Computer Incident Advisory Capability, is the computer
	security incident response team for the U.S. Department of Energy
	(DOE) and the emergency backup response team for the National
	Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
	National Laboratory in Livermore, California. CIAC is also a founding
	member of FIRST, the Forum of Incident Response and Security Teams, a
	global organization established to foster cooperation and coordination
	among computer security teams worldwide.
	
	CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
	can be contacted at:
		Voice:    +1 925-422-8193 (7x24)
		FAX:      +1 925-423-8002
		STU-III:  +1 925-423-2604
		E-mail:   ciac@ciac.org
	
	Previous CIAC notices, anti-virus software, and other information are
	available from the CIAC Computer Security Archive.
	
	   World Wide Web:      http://www.ciac.org/
	   Anonymous FTP:       ftp.ciac.org
	
	PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
	communities receive CIAC bulletins.  If you are not part of these
	communities, please contact your agency's response team to report
	incidents. Your agency's team will coordinate with CIAC. The Forum of
	Incident Response and Security Teams (FIRST) is a world-wide
	organization. A list of FIRST member organizations and their
	constituencies can be obtained via WWW at http://www.first.org/.
	
	This document was prepared as an account of work sponsored by an
	agency of the United States Government. Neither the United States
	Government nor the University of California nor any of their
	employees, makes any warranty, express or implied, or assumes any
	legal liability or responsibility for the accuracy, completeness, or
	usefulness of any information, apparatus, product, or process
	disclosed, or represents that its use would not infringe privately
	owned rights. Reference herein to any specific commercial products,
	process, or service by trade name, trademark, manufacturer, or
	otherwise, does not necessarily constitute or imply its endorsement,
	recommendation or favoring by the United States Government or the
	University of California. The views and opinions of authors expressed
	herein do not necessarily state or reflect those of the United States
	Government or the University of California, and shall not be used for
	advertising or product endorsement purposes.
	
	LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
	
	R-324: Vulnerability in Vector Markup Language
	R-325: Information Leakage Using IPv6 Routing Header
	R-326: tcpdump
	R-327: Cisco IOS Secure Copy Authorization Bypass Vulnerability
	R-328: Local Privilege Vulnerabilities in Cisco VPN Client
	R-329: Trend Micro ServerProtect Agent Vulnerabilities
	R-330: Asterisk Security Vulnerabilities
	R-331: HP-UX Running the Ignite-UX or the DynRootDisk (DRD) get_system_info Command
	R-332: MSN Messenger and Windows Live Messenger Webcam Vulnerability
	R-333: BIND Version 8 Vulnerable