Oracle Access Manager Multiple Vulnerabilities (Jan 2018 CPU)
critical Nessus Plugin ID 124059
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Oracle Access Manager installed on the remote host is 10.1.4.3.x prior to 10.1.4.3.13 or 11.1.2.3.x prior to 11.1.2.3.180116. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory:- A Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin (OpenSSL)). The affected version is 10.1.4.3.0. This is a difficult to exploit vulnerability that allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-3732)
- A vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The affected version is 11.1.2.3.0. This is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-10262)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patches according to the January 2018 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: Critical
ID: 124059
File Name: oracle_access_manager_cpu_jan_2018.nasl
Version: 1.5
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 4/15/2019
Updated: 4/11/2022
Supported Sensors: Nessus Agent
Risk Information
CVSS Score Source: CVE-2016-6303
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:POC/RL:OF/RC:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:fusion_middleware
Required KB Items: Oracle/OAM/Installed, installed_sw/Oracle Access Manager
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/18/2018
Vulnerability Publication Date: 1/18/2018
Reference Information
CVE: CVE-2016-2177, CVE-2016-2178, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6306, CVE-2016-7052, CVE-2016-7055, CVE-2017-3731, CVE-2017-3732, CVE-2017-10262
BID: 91081, 91319, 92117, 92557, 92628, 92630, 92982, 92984, 93150, 93153, 93171, 94242, 95813, 95814, 102562