Executive Summary

Title Allround Automations PL/SQL Developer v11 performs updates over HTTP
Name VU#229047 First vendor Publication 2016-04-25
Vendor VU-CERT Last vendor Modification 2016-05-02
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#229047

Allround Automations PL/SQL Developer v11 performs updates over HTTP

Original Release date: 25 Apr 2016 | Last revised: 02 May 2016


Allround Automations PL/SQL Developer version 11 checks for updates over HTTP and does not verify updates before executing commands, which may allow an attacker to execute arbitrary code.


CWE-345: Insufficient Verification of Data Authenticity - CVE-2016-2346

According to the researcher, Allround Automations PL/SQL Developer version 11 periodically checks for updates over HTTP. When an update is available, PL/SQL Developer downloads the update and executes the update without verifying authenticity or performing other checks.

By intercepting such requests and modifying the necessary fields, an attacker with a man-in-the-middle position between the victim and the network may be able write arbitrary data to vulnerable devices and execute arbitrary code with permissions of the PL/SQL Developer user.

The researcher has published a blog post with more information.


A remote attacker with a man-in-the-middle position may able to execute code with permissions of the PL/SQL Developer user.


Apply an update

PL/SQL Developer version 11.0.6 has been released to address this issue. The update utility now uses HTTPS and restricts downloads to the allroundautomations.com domain.

Affected users may also consider the following workaround:

Avoid untrusted networks

Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a man-in-the-middle attack that could intercept your HTTP data.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Allround AutomationsAffected15 Mar 201625 Apr 2016
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)



  • https://adamcaudill.com/2016/05/01/plsql-developer-http-to-command-execution/


Thanks to Adam Caudill for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:CVE-2016-2346
  • Date Public:29 Apr 2016
  • Date First Published:25 Apr 2016
  • Date Last Updated:02 May 2016
  • Document Revision:48


If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/229047

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-345 Insufficient Verification of Data Authenticity

CPE : Common Platform Enumeration

Application 6

Nessus® Vulnerability Scanner

Date Description
2016-04-29 Name : The application installed on the remote host is affected by a remote code exe...
File : plsql_developer_11_0_6.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-05-02 22:17:26
  • Multiple Updates
2016-05-02 21:26:26
  • Multiple Updates
2016-04-30 13:30:48
  • Multiple Updates
2016-04-29 21:23:16
  • Multiple Updates
2016-04-26 00:30:23
  • Multiple Updates
2016-04-25 17:24:02
  • First insertion