Oracle Fusion Middleware Oracle HTTP Server (Apr 2019 CPU)

critical Nessus Plugin ID 124156

Language:

Synopsis

The remote web server is affected by a stack-based buffer overflow vulnerability.

Description

The version of Oracle HTTP Server installed on the remote host is affected by a stack-based buffer overflow as noted in the April 2019 CPU advisory. The condition exists in the included cURL library due to using unsigned math when preventing the overflow. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to cause a denial of service condition or the execution of arbitrary code.

Solution

Apply the appropriate patch according to the April 2019 Oracle Critical Patch Update advisory.

Plugin Details

Severity: Critical

ID: 124156

File Name: oracle_http_server_cpu_apr_2019.nasl

Version: 1.11

Type: local

Agent: windows, macosx, unix

Family: Web Servers

Published: 4/18/2019

Updated: 6/19/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-3822

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:http_server

Required KB Items: Oracle/OHS/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/16/2019

Vulnerability Publication Date: 4/16/2019

Reference Information

CVE: CVE-2019-3822

BID: 106950

IAVA: 2019-A-0128

Detections

Analytics