SB2022012745 - Multiple vulnerabilities in Oracle Communications Diameter Signaling Router

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2021-34429)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper input validation when processing certain characters in URI. A remote attacker can send a specially crafted HTTP request with encoded characters in URI, bypass implemented security restrictions and access content of the WEB-INF directory.

2) Code Injection (CVE-ID: CVE-2021-44832)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote user with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.

3) Out-of-bounds write (CVE-ID: CVE-2021-21703)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the way PHP handles shared memory access, when using PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users. A child process can access shared memory with the main process and write to it. As a result, it is possible to cause the root process to conduct invalid memory reads and writes with root privileges. A local user can trigger an out-of-bounds write error and execute arbitrary code on the system with root privileges.

4) Resource exhaustion (CVE-ID: CVE-2021-42340)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when processing HTTP connections. A remote attacker can initiate multiple HTTP connections with the web server and consume all available memory on the system.

5) Improper input validation (CVE-ID: CVE-2021-37137)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Content Acquisition System (Netty) component in Oracle Commerce Guided Search. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpujan2022.html?947627