CVE-2019-2611
Information
Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology.
Crash Dump:
Stack
sccdu.dll + 0xF18C (id: 6e2, no function symbol available)
0x3DCF0C88 (Address not in executable memory, no function symbol available)
Registers
eax = 0x4A559000 xmm0 = 0x0
ebx = 0x4E2F0454 xmm1 = 0x0
ecx = 0x4BE9F000 xmm2 = 0x0
edx = 0x2E88CFE8 xmm3 = 0x0
esi = 0x4BE9F000 xmm4 = 0x0
edi = 0x77024F20 xmm5 = 0x0
esp = 0x75CDE4 xmm6 = 0x0
ebp = 0xCFC5948 xmm7 = 0x3FF0000000000000
Disassembly of stack frame 1 at sccdu.dll + 0xF18C
57f7f0a9 e842410000 call sccdu!OIFreeFrame+0xa90 (57f831f0)
57f7f0ae 8bf0 mov esi,eax
57f7f0b0 81c424010000 add esp,124h
57f7f0b6 89742420 mov dword ptr [esp+20h],esi
57f7f0ba 85f6 test esi,esi
57f7f0bc 0f8471090000 je sccdu!DUIsCellTextVertFlow+0x2293 (57f7fa33)
57f7f0c2 8b542414 mov edx,dword ptr [esp+14h]
57f7f0c6 8b4204 mov eax,dword ptr [edx+4]
57f7f0c9 89442450 mov dword ptr [esp+50h],eax
57f7f0cd 8b06 mov eax,dword ptr [esi]
57f7f0cf 8b4008 mov eax,dword ptr [eax+8]
57f7f0d2 8b8090020000 mov eax,dword ptr [eax+290h]
57f7f0d8 85c0 test eax,eax
57f7f0da 7407 je sccdu!DUIsCellTextVertFlow+0x1943 (57f7f0e3)
57f7f0dc 48 dec eax
57f7f0dd 89442454 mov dword ptr [esp+54h],eax
57f7f0e1 eb08 jmp sccdu!DUIsCellTextVertFlow+0x194b (57f7f0eb)
57f7f0e3 c744245400000000 mov dword ptr [esp+54h],0
57f7f0eb 66834c246402 or word ptr [esp+64h],2
57f7f0f1 837a0c00 cmp dword ptr [edx+0Ch],0
57f7f0f5 8b02 mov eax,dword ptr [edx]
57f7f0f7 8b3d3440fe57 mov edi,dword ptr [sccdu!oit::GenInfo::usingTabUI+0x1994 (57fe4034)]
57f7f0fd 89442458 mov dword ptr [esp+58h],eax
57f7f101 0f84d9010000 je sccdu!DUIsCellTextVertFlow+0x1b40 (57f7f2e0)
57f7f107 668b4208 mov ax,word ptr [edx+8]
57f7f10b 0fb7f8 movzx edi,ax
57f7f10e 6689442466 mov word ptr [esp+66h],ax
57f7f113 69c7b80b0000 imul eax,edi,0BB8h
57f7f119 897c2424 mov dword ptr [esp+24h],edi
57f7f11d 50 push eax
57f7f11e 6a00 push 0
57f7f120 89442438 mov dword ptr [esp+38h],eax
57f7f124 ff153440fe57 call dword ptr [sccdu!oit::GenInfo::usingTabUI+0x1994 (57fe4034)]
57f7f12a 50 push eax
57f7f12b ff154440fe57 call dword ptr [sccdu!oit::GenInfo::usingTabUI+0x19a4 (57fe4044)]
57f7f131 8bf0 mov esi,eax
57f7f133 89742468 mov dword ptr [esp+68h],esi
57f7f137 85f6 test esi,esi
57f7f139 750b jne sccdu!DUIsCellTextVertFlow+0x19a6 (57f7f146)
57f7f13b 53 push ebx
57f7f13c 6a1e push 1Eh
57f7f13e e87db70100 call sccdu!EmbeddedDUCreateFrameEx+0x1180 (57f9a8c0)
57f7f143 83c408 add esp,8
57f7f146 ff742430 push dword ptr [esp+30h]
57f7f14a 89742470 mov dword ptr [esp+70h],esi
57f7f14e 6a00 push 0
57f7f150 56 push esi
57f7f151 e842390600 call sccdu!oit::GenInfo::usingTabUI+0x3f8 (57fe2a98)
57f7f156 83c40c add esp,0Ch
57f7f159 85ff test edi,edi
57f7f15b 7422 je sccdu!DUIsCellTextVertFlow+0x19df (57f7f17f)
57f7f15d 8b6c2424 mov ebp,dword ptr [esp+24h]
57f7f161 8dbe80030000 lea edi,[esi+380h]
57f7f167 57 push edi
57f7f168 ff33 push dword ptr [ebx]
57f7f16a e801eb0400 call sccdu!DUSetStyleDefaultVal (57fcdc70)
57f7f16f 83c408 add esp,8
57f7f172 81c7b80b0000 add edi,0BB8h
57f7f178 4d dec ebp
57f7f179 75ec jne sccdu!DUIsCellTextVertFlow+0x19c7 (57f7f167)
57f7f17b 8b6c241c mov ebp,dword ptr [esp+1Ch]
57f7f17f 8b542414 mov edx,dword ptr [esp+14h]
57f7f183 8b3d3440fe57 mov edi,dword ptr [sccdu!oit::GenInfo::usingTabUI+0x1994 (57fe4034)]
57f7f189 8b4210 mov eax,dword ptr [edx+10h]
57f7f18c 83b8b00b000000 cmp dword ptr [eax+0BB0h],0 // current instruction
57f7f193 0f8447010000 je sccdu!DUIsCellTextVertFlow+0x1b40 (57f7f2e0)
57f7f199 6a18 push 18h
57f7f19b 6a00 push 0
57f7f19d ffd7 call edi
57f7f19f 50 push eax
57f7f1a0 ff154440fe57 call dword ptr [sccdu!oit::GenInfo::usingTabUI+0x19a4 (57fe4044)]
57f7f1a6 8986b00b0000 mov dword ptr [esi+0BB0h],eax
57f7f1ac 85c0 test eax,eax
57f7f1ae 750b jne sccdu!DUIsCellTextVertFlow+0x1a1b (57f7f1bb)
57f7f1b0 53 push ebx
57f7f1b1 6a1e push 1Eh
57f7f1b3 e808b70100 call sccdu!EmbeddedDUCreateFrameEx+0x1180 (57f9a8c0)
57f7f1b8 83c408 add esp,8
57f7f1bb 8b542414 mov edx,dword ptr [esp+14h]
57f7f1bf 8b4210 mov eax,dword ptr [edx+10h]
57f7f1c2 8b80b00b0000 mov eax,dword ptr [eax+0BB0h]
57f7f1c8 83780c00 cmp dword ptr [eax+0Ch],0
57f7f1cc 0f84cf000000 je sccdu!DUIsCellTextVertFlow+0x1b01 (57f7f2a1)
57f7f1d2 0fb74008 movzx eax,word ptr [eax+8]
57f7f1d6 69c0b80b0000 imul eax,eax,0BB8h
57f7f1dc 50 push eax
57f7f1dd 6a00 push 0
57f7f1df ffd7 call edi
57f7f1e1 50 push eax
57f7f1e2 ff154440fe57 call dword ptr [sccdu!oit::GenInfo::usingTabUI+0x19a4 (57fe4044)]
57f7f1e8 8b8eb00b0000 mov ecx,dword ptr [esi+0BB0h]
57f7f1ee 89410c mov dword ptr [ecx+0Ch],eax
57f7f1f1 8b86b00b0000 mov eax,dword ptr [esi+0BB0h]
57f7f1f7 83780c00 cmp dword ptr [eax+0Ch],0
57f7f1fb 750b jne sccdu!DUIsCellTextVertFlow+0x1a68 (57f7f208)
57f7f1fd 53 push ebx
57f7f1fe 6a1e push 1Eh
57f7f200 e8bbb60100 call sccdu!EmbeddedDUCreateFrameEx+0x1180 (57f9a8c0)
57f7f205 83c408 add esp,8
57f7f208 8b8eb00b0000 mov ecx,dword ptr [esi+0BB0h]
57f7f20e 8b410c mov eax,dword ptr [ecx+0Ch]
57f7f211 894110 mov dword ptr [ecx+10h],eax
57f7f214 33c9 xor ecx,ecx
57f7f216 8b442414 mov eax,dword ptr [esp+14h]
57f7f21a 8b4010 mov eax,dword ptr [eax+10h]
57f7f21d 8b80b00b0000 mov eax,dword ptr [eax+0BB0h]
57f7f223 663b4808 cmp cx,word ptr [eax+8]
57f7f227 7348 jae sccdu!DUIsCellTextVertFlow+0x1ad1 (57f7f271)
57f7f229 33ff xor edi,edi
57f7f22b 33ed xor ebp,ebp
57f7f22d 8d4900 lea ecx,[ecx]
57f7f230 8b86b00b0000 mov eax,dword ptr [esi+0BB0h]
57f7f236 8b4010 mov eax,dword ptr [eax+10h]
57f7f239 0580030000 add eax,380h
PoC
Attached
Attachments:
id_000047_00.pdf
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-2611
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html