Oracle Database Multiple Vulnerabilities (July 2017 CPU) (POODLE) (SWEET32)

High Nessus Plugin ID 101836


The remote database server is affected by multiple vulnerabilities.


The remote Oracle Database Server is missing the July 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :

- A man-in-the-middle (MitM) information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

- A vulnerability exists, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficient resources can exploit this vulnerability, via a 'birthday' attack, to detect a collision that leaks the XOR between the fixed secret and a known plaintext, allowing the disclosure of the secret text, such as secure HTTPS cookies, and possibly resulting in the hijacking of an authenticated session.

- An unspecified vulnerability exists in the RDBMS Security component that allows a local attacker to impact integrity. Note that the attacker would need to have Create Session or Select Any Dictionary privileges.

- An unspecified vulnerability exists in the OJVM component that allows an authenticated, remote attacker to impact confidentiality, integrity, and availability.
Note that the attacker would need to have Create Session or Create Procedure privileges. (CVE-2017-10202)


Apply the appropriate patch according to the July 2017 Oracle Critical Patch Update advisory.

See Also

Plugin Details

Severity: High

ID: 101836

File Name: oracle_rdbms_cpu_jul_2017.nasl

Version: $Revision: 1.6 $

Type: local

Family: Databases

Published: 2017/07/20

Modified: 2017/10/19

Dependencies: 45624, 71644

Risk Information

Risk Factor: High


Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C


Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:oracle:database_server

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2017/07/18

Vulnerability Publication Date: 2014/10/14

Reference Information

CVE: CVE-2014-3566, CVE-2016-2183, CVE-2017-10120, CVE-2017-10202

BID: 70574, 92630

OSVDB: 113251, 143387, 143388, 161206, 161208

CERT: 577193