Oracle Application Testing Suite Multiple Vulnerabilities (April / July 2018 CPU)

High Nessus Plugin ID 111210

Synopsis

The remote host has a web application installed that is affected by multiple vulnerabilities.

Description

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities :

- A remote code execution vulnerability exists in Apache Log4j 2.x before 2.8.2 due to the ability to receive serialized log events from another application. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2017-5645)

- A remote code execution vulnerability exists in Spring Framework due to the exposure of STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2018-1275)

Solution

Apply the appropriate patch according to the April / July 2018 Oracle Critical Patch Update advisory.

See Also

http://www.nessus.org/u?76507bf8

http://www.nessus.org/u?50f36723

Plugin Details

Severity: High

ID: 111210

File Name: oracle_oats_cpu_jul_2018.nasl

Version: 1.2

Type: local

Family: Misc.

Published: 2018/07/20

Modified: 2018/09/17

Dependencies: 90860

Risk Information

Risk Factor: High

CVSS Score Source: CVE-2018-1275

CVSS v2.0

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:oracle:application_testing_suite

Required KB Items: installed_sw/Oracle Application Testing Suite

Patch Publication Date: 2018/07/17

Vulnerability Publication Date: 2018/07/17

Reference Information

CVE: CVE-2017-5645, CVE-2018-1275

BID: 97702, 103771