Oracle GoldenGate Manager < OBEY Command ggserr.log File Handling RCE

Critical Nessus Plugin ID 100620


The Oracle GoldenGate Manager application running on the remote host is affected by a remote code execution vulnerability.


According to its self-reported version number, the Oracle GoldenGate Manager application running on the remote host is prior to
It is, therefore, affected by a remote code execution vulnerability due to improper handling of 'OBEY' commands and the ggserr.log file.
An unauthenticated, remote attacker can exploit this to execute arbitrary code by entering a 'SHELL' command into the error log and then executing the error log via the 'OBEY' command.

Note that newer versions of Oracle GoldenGate Manager do not fix this issue but instead introduce access controls that disallow use of 'OBEY' by default.


Upgrade to Oracle GoldenGate Manager version and use appropriate access controls to disallow the use of the 'OBEY' command.

See Also

Plugin Details

Severity: Critical

ID: 100620

File Name: golden_gate_err_log_execution.nasl

Version: $Revision: 1.3 $

Type: remote

Family: Misc.

Published: 2017/06/05

Modified: 2017/08/15

Dependencies: 100621

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 9.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:U/RC:ND


Base Score: 9.8

Temporal Score: 9.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:oracle:goldengate

Required KB Items: gg_manager/present

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2017/05/08

Reference Information

OSVDB: 157452

EDB-ID: 41978