Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability

Microosft published an unusual knowledge base article today, warning users of certain versions of Microsoft Exchange and Sharepoint server of a remote code execution vulnerability introduced by Oracle's  "Outside In" libraries that are included with these products. [1]

Affected Products:

Microsoft Exchange Server 2007
Microsoft Exchange Server 2010
FAST Search Server 2010 for Sharepoint

Oracle provided a patch for this issue in it's July patch release [2]. The issue si covered by Oracles "Fusion Middleware" fix. Outside in library version and earlier is vulnerable. The fixed version is (US Cert also mentions as fixed).

As a work around, you could disable the transcoding service, but it will no longer allow you to preview attachments. Or you could disable the advanced filter pack on FAST Search Server 2010 for SharePoint. 

Oracle's "Outdside In" libraries are able to decode over 500 different file formats [3]. The libraries are used to be able to index content inside files like PDFs and other common file types. 

It is very likely, that not only Microsoft's software is including this library. US-CERT provides a list of software that they identified.


Johannes B. Ullrich, Ph.D.
SANS Technology Institute

I will be teaching next: Defending Web Applications Security Essentials - SANS Cyber Defense Initiative 2021


4306 Posts
ISC Handler
Jul 25th 2012
Not to be picky but you missed an S in SharePoint "Search Server 2010 for harePoint."

65 Posts
Note that exploits are publicly available!

Based on [3] above I conducted some research on possible other (non-Microsoft) vulnerable applications that use the affected Oracle Outside In libraries.

This appears to include commonly used apps as ACDSee, Quick View Plus, McAfee Groupshield, Novell GroupWise, various "paperless office" apps, but also forensics software such as EnCase and FTK (see also:

Some more details (in Dutch, but English-only readers probably get the idea) can be found in - look for the gray rectangles in my second comment.
Erik van Straten

129 Posts
Noteworthy is perhaps that US-CERT warned Microsoft (on 26 Mar 2012!) for multiple exploitable vulnerabilities in "Oracle Outside In" as used in the "WebReady document viewing feature" in Microsoft Exchange 2007 and 2010.

Apparently the Microsoft-Oracle battle results in security negligence affecting lots of Microsoft customers?

See also Jürgen Schmidt's -German- comment in (probaly soon to appear -in English0 on
Erik van Straten

129 Posts
Novell GroupWise also used these libraries.

24 Posts

Sign Up for Free or Log In to start participating in the conversation!