cnvd - cnvd-2017-06043

CNVD-2017-06043

Vulnerability from cnvd - Published: 2017-05-06

Title

Oracle Enterprise Manager Base Platform拒绝服务漏洞

Description

Oracle Enterprise Manager Grid Control是美国甲骨文（Oracle）公司的一套系统管理软件。该软件为Oracle IT架构提供中心化监视、生命周期管理等功能。Oracle Enterprise Manager Base Platform是其中的一个系统管理平台组件。 Oracle Enterprise Manager Grid Control中的Enterprise Manager Base Platform组件的Discovery Framework子组件存在安全漏洞。攻击者可利用该漏洞造成拒绝服务（挂起或频繁崩溃），影响数据的可用性。

Severity

中

Patch Name

Oracle Enterprise Manager Base Platform拒绝服务漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-3518

Impacted products

Name
['Oracle Enterprise Manager Base Platform 12.1', 'Oracle Enterprise Manager Base Platform 13.2.0.0', 'Oracle Enterprise Manager Base Platform 13.1.0.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97720"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3518",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3518"
    }
  },
  "description": "Oracle Enterprise Manager Grid Control\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u7cfb\u7edf\u7ba1\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u4e3aOracle IT\u67b6\u6784\u63d0\u4f9b\u4e2d\u5fc3\u5316\u76d1\u89c6\u3001\u751f\u547d\u5468\u671f\u7ba1\u7406\u7b49\u529f\u80fd\u3002Oracle Enterprise Manager Base Platform\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7cfb\u7edf\u7ba1\u7406\u5e73\u53f0\u7ec4\u4ef6\u3002\r\n\r\nOracle Enterprise Manager Grid Control\u4e2d\u7684Enterprise Manager Base Platform\u7ec4\u4ef6\u7684Discovery Framework\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6302\u8d77\u6216\u9891\u7e41\u5d29\u6e83\uff09\uff0c\u5f71\u54cd\u6570\u636e\u7684\u53ef\u7528\u6027\u3002",
  "discovererName": "Oracle",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-06043",
  "openTime": "2017-05-06",
  "patchDescription": "Oracle Enterprise Manager Grid Control\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u7cfb\u7edf\u7ba1\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u4e3aOracle IT\u67b6\u6784\u63d0\u4f9b\u4e2d\u5fc3\u5316\u76d1\u89c6\u3001\u751f\u547d\u5468\u671f\u7ba1\u7406\u7b49\u529f\u80fd\u3002Oracle Enterprise Manager Base Platform\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7cfb\u7edf\u7ba1\u7406\u5e73\u53f0\u7ec4\u4ef6\u3002\r\n\r\nOracle Enterprise Manager Grid Control\u4e2d\u7684Enterprise Manager Base Platform\u7ec4\u4ef6\u7684Discovery Framework\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6302\u8d77\u6216\u9891\u7e41\u5d29\u6e83\uff09\uff0c\u5f71\u54cd\u6570\u636e\u7684\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Enterprise Manager Base Platform\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle Enterprise Manager Base Platform 12.1",
      "Oracle Enterprise Manager Base Platform  13.2.0.0",
      "Oracle Enterprise Manager Base Platform  13.1.0.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-3518",
  "serverity": "\u4e2d",
  "submitTime": "2017-04-20",
  "title": "Oracle Enterprise Manager Base Platform\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2017-3518 (GCVE-0-2017-3518)

Vulnerability from cvelistv5 – Published: 2017-04-24 19:00 – Updated: 2024-10-04 19:25

Summary

Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Discovery Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Severity ?

No CVSS data available.

CWE

Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform.

Assigner

oracle

References

URL

Tags

	http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/97720	vdb-entryx_refsource_BID
	http://www.securitytracker.com/id/1038297	vdb-entryx_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Enterprise Manager Base Platform	Affected: 12.1.0 Affected: 13.1.0 Affected: 13.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:30:57.588Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
          },
          {
            "name": "97720",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97720"
          },
          {
            "name": "1038297",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038297"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-3518",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-04T16:20:14.603962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-04T19:25:14.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Enterprise Manager Base Platform",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.0"
            },
            {
              "status": "affected",
              "version": "13.1.0"
            },
            {
              "status": "affected",
              "version": "13.2.0"
            }
          ]
        }
      ],
      "datePublic": "2017-04-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Discovery Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T09:57:01",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
        },
        {
          "name": "97720",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97720"
        },
        {
          "name": "1038297",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038297"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2017-3518",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Enterprise Manager Base Platform",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "12.1.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "13.1.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "13.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Discovery Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
            },
            {
              "name": "97720",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97720"
            },
            {
              "name": "1038297",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038297"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2017-3518",
    "datePublished": "2017-04-24T19:00:00",
    "dateReserved": "2016-12-06T00:00:00",
    "dateUpdated": "2024-10-04T19:25:14.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-06043

CVE-2017-3518 (GCVE-0-2017-3518)

Tags

Sightings

Nomenclature