CVE-2010-3599

published 2011-01-19

CVE-2010-3599: Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect…

Priority P2 61 critical 9.4 CVSS 2.0

AV N AC L Au N C N I C A C

EXPLOIT

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect integrity and availability via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite arbitrary files and execute arbitrary code via a full pathname in the first argument to the WriteJPG method in the NCSECWLib ActiveX control.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	fusion_middleware	—	—
oracle	fusion_middleware	—	—

Detection & IOCs extracted from sources · hover to see the quote

other NCSECWLib.NCSRenderer↗

command WriteJPG↗

path C:\Program Files\Oracle\Document Capture\NCSEcw.dll↗

snort

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture File Overwrite or Buffer Overflow Attempt"; flow:established,to_client; file.data; content:"ActiveXObject"; nocase; content:"NCSECWLib.NCSRenderer"; fast_pattern; nocase; distance:0; content:"WriteJPG"; nocase; distance:0; reference:cve,2010-3599; classtype:attempted-user; sid:2012234; rev:6; metadata:created_at 2011_01_27, cve CVE_2010_3599, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_09;)

• → Detect exploit attempts by looking for HTTP responses containing both 'NCSECWLib.NCSRenderer' (ActiveX ProgID) and 'WriteJPG' method call in the same page, indicating an attempt to abuse the insecure ActiveX method. ↗
• → Buffer overflow attempts can be identified by an abnormally long first argument to WriteJPG (e.g., a string of ~13332 repeated characters) passed via the ActiveX control. ↗
• → File overwrite attempts target sensitive system paths as the first argument to WriteJPG, such as 'c:\boot.ini', delivered via a malicious HTML page. ↗

• · Oracle has not publicly confirmed the specific attack vector; the technical details (WriteJPG method, NCSECWLib.NCSRenderer ProgID) originate from the original researcher's disclosure, not Oracle's official CPU advisory. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.