Doesn’t look like Oracle has a bounty program……
Clay Jackson
From: Noveljic Nenad <nenad.noveljic@xxxxxxxxxxxx>
Sent: Tuesday, July 12, 2022 9:56 AM
To: Maris Elsins <elmaris@xxxxxxxxx>; Clay Jackson (cjackson)
<Clay.Jackson@xxxxxxxxx>; ORACLE-L <oracle-l@xxxxxxxxxxxxx>
Subject: RE: Security privilege escalation
CAUTION: This email originated from outside of the organization. Do not follow
guidance, click links, or open attachments unless you recognize the sender and
know the content is safe.
Thank you all for the guidelines.
I’m going to inform both Oracle and CERT coordination center and then publish
the investigation on my blog after the summer holidays.
Is there a way to monetize my discovery (I don’t mean with some illegal
activities, but getting a reward for finding the security breach :))?
Best regards,
Nenad
From: Maris Elsins <elmaris@xxxxxxxxx<mailto:elmaris@xxxxxxxxx>>
Sent: Dienstag, 12. Juli 2022 18:43
To: Clay.Jackson@xxxxxxxxx<mailto:Clay.Jackson@xxxxxxxxx>
Cc: Noveljic Nenad
<nenad.noveljic@xxxxxxxxxxxx<mailto:nenad.noveljic@xxxxxxxxxxxx>>; ORACLE-L
<oracle-l@xxxxxxxxxxxxx<mailto:oracle-l@xxxxxxxxxxxxx>>
Subject: Re: Security privilege escalation
*** E-Mail from outside Vontobel: Do not click on links or open attachments
unless you know the content is safe. ***
There's a special email address to report security issues.
https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting.html<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.oracle.com%2Fcorporate%2Fsecurity-practices%2Fassurance%2Fvulnerability%2Freporting.html&data=05%7C01%7Cclay.jackson%40quest.com%7Cdd7060a8ff4c4208fa8d08da642768d0%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637932417669889515%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=dnsvfa1HzdatYh7YgHddnm6kV5krvoRXliJn%2BDlzW7s%3D&reserved=0>
---
Māris Elsiņš
On Tue, Jul 12, 2022 at 7:38 PM Clay Jackson
<dmarc-noreply@xxxxxxxxxxxxx<mailto:dmarc-noreply@xxxxxxxxxxxxx>> wrote:
What JL said; or, perhaps follow this process.
CERT Vulnerability Notes
Database<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.kb.cert.org%2Fvuls%2Freport%2F%23%3A~%3Atext%3DReport%2520a%2520Vulnerability%2520Before%2520reporting%2520any%2520vulnerabilities%2520to%2Cpolicy%2520and%2520guidance%2520before%2520submitting%2520a%2520vulnerability%2520report.&data=05%7C01%7Cclay.jackson%40quest.com%7Cdd7060a8ff4c4208fa8d08da642768d0%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637932417670201466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7JDgUe6sFIpKr8fvqhkQxgW7xbDKLMjsPAJio5lhYss%3D&reserved=0>
Clay Jackson
From: oracle-l-bounce@xxxxxxxxxxxxx<mailto:oracle-l-bounce@xxxxxxxxxxxxx>
<oracle-l-bounce@xxxxxxxxxxxxx<mailto:oracle-l-bounce@xxxxxxxxxxxxx>> On Behalf
Of Noveljic Nenad
Sent: Tuesday, July 12, 2022 9:20 AM
To: ORACLE-L <oracle-l@xxxxxxxxxxxxx<mailto:oracle-l@xxxxxxxxxxxxx>>
Subject: Security privilege escalation
CAUTION: This email originated from outside of the organization. Do not follow
guidance, click links, or open attachments unless you recognize the sender and
know the content is safe.
I found a way to escalate privileges from grid to root.
Am I allowed to publish the information on my blog?
Best regards,
Nenad
____________________________________________________
Please consider the environment before printing this e-mail.
Bitte denken Sie an die Umwelt, bevor Sie dieses E-Mail drucken.
Important Notice
This message is intended only for the individual named. It may contain
confidential or privileged information. If you are not the named addressee you
should in particular not disseminate, distribute, modify or copy this e-mail.
Please notify the sender immediately by e-mail, if you have received this
message by mistake and delete it from your system.
Without prejudice to any contractual agreements between you and us which shall
prevail in any case, we take it as your authorization to correspond with you by
e-mail if you send us messages by e-mail. However, we reserve the right not to
execute orders and instructions transmitted by e-mail at any time and without
further explanation.
E-mail transmission may not be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete. Also
processing of incoming e-mails cannot be guaranteed. All liability of Vontobel
Holding Ltd. and any of its affiliates (hereinafter collectively referred to as
"Vontobel Group") for any damages resulting from e-mail use is excluded. You
are advised that urgent and time sensitive messages should not be sent by
e-mail and if verification is required please request a printed version.
Please note that all e-mail communications to and from the Vontobel Group are
subject to electronic storage and review by Vontobel Group. Unless stated to
the contrary and without prejudice to any contractual agreements between you
and Vontobel Group which shall prevail in any case, e-mail-communication is for
informational purposes only and is not intended as an offer or solicitation for
the purchase or sale of any financial instrument or as an official confirmation
of any transaction.
The legal basis for the processing of your personal data is the legitimate
interest to develop a commercial relationship with you, as well as your consent
to forward you commercial communications. You can exercise, at any time and
under the terms established under current regulation, your rights. If you
prefer not to receive any further communications, please contact your client
relationship manager if you are a client of Vontobel Group or notify the
sender. Please note for an exact reference to the affected group entity the
corporate e-mail signature. For further information about data privacy at
Vontobel Group please consult
www.vontobel.com<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vontobel.com%2F&data=05%7C01%7Cclay.jackson%40quest.com%7Cdd7060a8ff4c4208fa8d08da642768d0%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637932417670201466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=dcSOOn4R3b39GNqrnxlSDlt6oKDk6LHSJX7GIb5h%2BNI%3D&reserved=0>.
Important Notice
This message is intended only for the individual named. It may contain
confidential or privileged information. If you are not the named addressee you
should in particular not disseminate, distribute, modify or copy this e-mail.
Please notify the sender immediately by e-mail, if you have received this
message by mistake and delete it from your system.
Without prejudice to any contractual agreements between you and us which shall
prevail in any case, we take it as your authorization to correspond with you by
e-mail if you send us messages by e-mail. However, we reserve the right not to
execute orders and instructions transmitted by e-mail at any time and without
further explanation.
E-mail transmission may not be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete. Also
processing of incoming e-mails cannot be guaranteed. All liability of Vontobel
Holding Ltd. and any of its affiliates (hereinafter collectively referred to as
"Vontobel Group") for any damages resulting from e-mail use is excluded. You
are advised that urgent and time sensitive messages should not be sent by
e-mail and if verification is required please request a printed version.
Please note that all e-mail communications to and from the Vontobel Group are
subject to electronic storage and review by Vontobel Group. Unless stated to
the contrary and without prejudice to any contractual agreements between you
and Vontobel Group which shall prevail in any case, e-mail-communication is for
informational purposes only and is not intended as an offer or solicitation for
the purchase or sale of any financial instrument or as an official confirmation
of any transaction.
The legal basis for the processing of your personal data is the legitimate
interest to develop a commercial relationship with you, as well as your consent
to forward you commercial communications. You can exercise, at any time and
under the terms established under current regulation, your rights. If you
prefer not to receive any further communications, please contact your client
relationship manager if you are a client of Vontobel Group or notify the
sender. Please note for an exact reference to the affected group entity the
corporate e-mail signature. For further information about data privacy at
Vontobel Group please consult
www.vontobel.com<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vontobel.com%2F&data=05%7C01%7Cclay.jackson%40quest.com%7Cdd7060a8ff4c4208fa8d08da642768d0%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637932417670201466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=dcSOOn4R3b39GNqrnxlSDlt6oKDk6LHSJX7GIb5h%2BNI%3D&reserved=0>.