Oracle Secure Global Desktop Multiple Vulnerabilities (July 2014 CPU)

high Nessus Plugin ID 76570

Language:

Synopsis

The remote host has a version of Oracle Secure Global Desktop that is affected by multiple vulnerabilities.

Description

The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by the following vulnerabilities :

- Apache Tomcat does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks.
(CVE-2013-4286)

- CoyoteAdapter.java in Apache Tomcat does not consider the 'disableURLRewriting' setting when handling session ID in a URL, allowing a remote attacker to conduct session fixation attacks via a crafted URL.
(CVE-2014-0033)

- The 'log_cookie' function in mod_log_config.c of Apache will not handle specially crafted cookies during truncation, allowing a remote attacker to cause a denial of service via a segmentation fault. (CVE-2014-0098)

- Multiple integer overflows within X.Org libXfont that could allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. (CVE-2014-0211)

- OpenSSL does not properly restrict processing of 'ChangeCipherSpec' messages which allows man-in-the-middle attackers to trigger use of a zero-length master key and consequently hijack sessions or obtain sensitive information via a crafted TLS handshake. (CVE-2014-0224)

- An unspecified flaw related to the Workspace Web Application subcomponent could allow a remote attacker to impact integrity. (CVE-2014-4232)

Solution

Apply the appropriate patch according to the July 2014 Oracle Critical Patch Update advisory.

Plugin Details

Severity: High

ID: 76570

File Name: oracle_secure_global_desktop_jul_2014_cpu.nasl

Version: 1.10

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 7/17/2014

Updated: 10/25/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:oracle:virtualization_secure_global_desktop

Required KB Items: Host/Oracle_Secure_Global_Desktop/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/15/2014

Vulnerability Publication Date: 2/26/2014

Exploitable With

Core Impact

Reference Information

CVE: CVE-2013-4286, CVE-2014-0033, CVE-2014-0098, CVE-2014-0211, CVE-2014-0224, CVE-2014-4232

BID: 65769, 65773, 66303, 67382, 67899, 68606

CERT: 978508

Detections

Analytics