PT-2013-08: Remote OS Command Execution in Oracle Siebel CRM Vulnerable softwareOracle Siebel CRM Version: 8.1.1, 8.2.2Link: http://www.oracle.com/us/products/applications/siebel/overview/index.htmlSeverity levelSeverity level: Medium Impact: Remote OS Command Execution Access Vector: Remote CVSS v2: Base Score: 5.8 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)CVE: CVE-2013-5761Software descriptionOracle Siebel CRM is a customer relationship management application used to develop a complex corporate information system. Vulnerability descriptionThe specialists of the Positive Research center have detected a Remote OS Command Execution vulnerability in Oracle Siebel CRM.An attacker is able to execute arbitrary commands on the target system with current user's privileges and also access its file system using eScript embedded tools.How to fixUpdate your software up to the latest versionAdvisory status05.02.2013 - Vendor gets vulnerability details 15.10.2013 - Vendor releases fixed version and details 25.10.2013 - Public disclosureCreditsThe vulnerability was detected by Nikita Mikhalevsky, Positive Research Center (Positive Technologies Company)Referenceshttp://en.securitylab.ru/lab/PT-2013-08 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html Reports on the vulnerabilities previously discovered by Positive Research:http://www.ptsecurity.com/research/advisory/ http://en.securitylab.ru/lab/