Oracle Database Multiple Vulnerabilities (July 2017 CPU) (POODLE) (SWEET32)

critical Nessus Plugin ID 101836


The remote database server is affected by multiple vulnerabilities.


The remote Oracle Database Server is missing the July 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :

- A man-in-the-middle (MitM) information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

- A vulnerability exists, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficient resources can exploit this vulnerability, via a 'birthday' attack, to detect a collision that leaks the XOR between the fixed secret and a known plaintext, allowing the disclosure of the secret text, such as secure HTTPS cookies, and possibly resulting in the hijacking of an authenticated session.

- An unspecified vulnerability exists in the RDBMS Security component that allows a local attacker to impact integrity. Note that the attacker would need to have Create Session or Select Any Dictionary privileges.

- An unspecified vulnerability exists in the OJVM component that allows an authenticated, remote attacker to impact confidentiality, integrity, and availability.
Note that the attacker would need to have Create Session or Create Procedure privileges. (CVE-2017-10202)


Apply the appropriate patch according to the July 2017 Oracle Critical Patch Update advisory.

See Also

Plugin Details

Severity: Critical

ID: 101836

File Name: oracle_rdbms_cpu_jul_2017.nasl

Version: 1.16

Type: combined

Agent: windows, macosx, unix

Family: Databases

Published: 7/20/2017

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: Medium

Score: 6.5


Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: E:POC/RL:OF/RC:C

CVSS Score Source: CVE-2017-10202


Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:database_server

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/18/2017

Vulnerability Publication Date: 10/14/2014

Reference Information

CVE: CVE-2014-3566, CVE-2016-2183, CVE-2017-10120, CVE-2017-10202

BID: 70574, 92630

CERT: 577193