Detections
Analytics
Oracle Secure Global Desktop Multiple Vulnerabilities (January 2018 CPU)
critical Nessus Plugin ID 106199
Language:
Synopsis
An application installed on the remote host is affected by multiple vulnerabilities.Description
The version of Oracle Secure Global Desktop installed on the remote host is 5.3 and is missing a security patch from the January 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:- The included OpenSSL library has a off-by-one out-of-bounds read flaw within the X509v3_addr_get_afi() function of crypto/x509v3/v3_addr.c when handling the IPAddressFamily extension of X.509 certificates. A content-dependent attacker, with a specially crafted request, could potentially read limited memory information. (CVE-2017-3735)
- The included OpenSSL library has a carry propagating flaw within the bn_sqrx8x_internal() function in crypto/bn/asm/x86_64-mont5.pl when handling RSA / DSA encryption. A content-dependent attacker, with a specially crafted request, could potentially determine the private key. (CVE-2017-3736)
- The included Apache Log4j contains a flaw due to improper validation of log events before deserializing. A remote attacker, with a specially crafted log event, could potentially execute arbitrary script code. (CVE-2017-5645)
Solution
Apply the appropriate patch according to the January 2018 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: Critical
ID: 106199
File Name: oracle_secure_global_desktop_jan_2018_cpu.nasl
Version: 1.7
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 1/19/2018
Updated: 10/25/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:virtualization_secure_global_desktop
Required KB Items: Host/Oracle_Secure_Global_Desktop/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2018
Vulnerability Publication Date: 8/17/2017