Oracle Secure Global Desktop Multiple Vulnerabilities (July 2014 CPU)
high Nessus Plugin ID 76570
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote host has a version of Oracle Secure Global Desktop that is affected by multiple vulnerabilities.Description
The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by the following vulnerabilities :- Apache Tomcat does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks.
(CVE-2013-4286)
- CoyoteAdapter.java in Apache Tomcat does not consider the 'disableURLRewriting' setting when handling session ID in a URL, allowing a remote attacker to conduct session fixation attacks via a crafted URL.
(CVE-2014-0033)
- The 'log_cookie' function in mod_log_config.c of Apache will not handle specially crafted cookies during truncation, allowing a remote attacker to cause a denial of service via a segmentation fault. (CVE-2014-0098)
- Multiple integer overflows within X.Org libXfont that could allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. (CVE-2014-0211)
- OpenSSL does not properly restrict processing of 'ChangeCipherSpec' messages which allows man-in-the-middle attackers to trigger use of a zero-length master key and consequently hijack sessions or obtain sensitive information via a crafted TLS handshake. (CVE-2014-0224)
- An unspecified flaw related to the Workspace Web Application subcomponent could allow a remote attacker to impact integrity. (CVE-2014-4232)
Solution
Apply the appropriate patch according to the July 2014 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: High
ID: 76570
File Name: oracle_secure_global_desktop_jul_2014_cpu.nasl
Version: 1.10
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 7/17/2014
Updated: 10/25/2021
Dependencies: oracle_secure_global_desktop_installed.nbin
Risk Information
VPR
Risk Factor: High
Score: 7.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:F/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:virtualization_secure_global_desktop
Required KB Items: Host/Oracle_Secure_Global_Desktop/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/15/2014
Vulnerability Publication Date: 2/26/2014
Exploitable With
Core Impact
Reference Information
CVE: CVE-2013-4286, CVE-2014-0033, CVE-2014-0098, CVE-2014-0211, CVE-2014-0224, CVE-2014-4232
CERT: 978508