Synopsis
An enterprise management application installed on the remote host is affected by multiple vulnerabilities.
Description
The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:
- A deserialization vulnerability in Apache Commons FileUpload allows for remote code execution.
(CVE-2016-1000031)
- An information disclosure vulnerability exists in OpenSSL due to the potential for a side-channel timing attack.
An unauthenticated attacker can exploit this to disclose potentially sensitive information. (CVE-2018-0734)
- A denial of service (DoS) vulnerability exists in Apache HTTP Server 2.4.17 to 2.4.34, due to a design error. An unauthenticated, remote attacker can exploit this issue by sending continuous, large SETTINGS frames to cause a client to occupy a connection, server thread and CPU time without any connection timeout coming to effect.
This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
(CVE-2018-11763).
- Networking component of Enterprise Manager Base Platform (Spring Framework) is easily exploited and may allow an unauthenticated, remote attacker to takeover the Enterprise Manager Base Platform. (CVE-2018-1258)
Solution
Apply the appropriate patch according to the April 2019 Oracle Critical Patch Update advisory.