SB2018101616 - Multiple vulnerabilities in Oracle Database Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101616

SB2018101616 - Multiple vulnerabilities in Oracle Database Server

Published: October 16, 2018

Security Bulletin ID SB2018101616
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Deserialization of untrusted data (CVE-ID: CVE-2018-7489)

The vulnerability allows a remote unauthenticated attacker to bypass security restrictions and execute arbitrary code on the target system.

The weakness exists in the readValue method due to improper validation of user-input. A remote attacker can send malicious JSON input, bypass security restrictions and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

2) Improper input validation (CVE-ID: CVE-2018-3299)

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Oracle Text in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.


3) Improper input validation (CVE-ID: CVE-2018-3259)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Remediation

Install update from vendor's website.

References