Vulnerability-Lookup

CNVD-2017-06100

Vulnerability from cnvd - Published: 2017-05-09

Title

Oracle Automatic Service Request远程漏洞

Description

Automatic Service Request(ASR)是一款可在发生常见硬件组件故障时提供自动案例生成的“Oracle支持服务”。 Oracle Automatic Service Request存在远程漏洞。攻击者可通过HTTP协议利用漏洞使“ASR Manager”子组件受到影响。

Severity

高

Patch Name

Oracle Automatic Service Request远程漏洞的补丁

Patch Description

Automatic Service Request(ASR)是一款可在发生常见硬件组件故障时提供自动案例生成的“Oracle支持服务”。 Oracle Automatic Service Request存在远程漏洞。攻击者可通过HTTP协议利用漏洞使“ASR Manager”子组件受到影响。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可联系供应商获得补丁信息： https://www.oracle.com/

Reference

http://www.securityfocus.com/bid/97799

Impacted products

Name
['Oracle Automatic Service Request 4.3.1', 'Oracle Automatic Service Request 4.3.2']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97799"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3233"
    }
  },
  "description": "Automatic Service Request(ASR)\u662f\u4e00\u6b3e\u53ef\u5728\u53d1\u751f\u5e38\u89c1\u786c\u4ef6\u7ec4\u4ef6\u6545\u969c\u65f6\u63d0\u4f9b\u81ea\u52a8\u6848\u4f8b\u751f\u6210\u7684\u201cOracle\u652f\u6301\u670d\u52a1\u201d\u3002\r\n\r\nOracle Automatic Service Request\u5b58\u5728\u8fdc\u7a0b\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7HTTP\u534f\u8bae\u5229\u7528\u6f0f\u6d1e\u4f7f\u201cASR Manager\u201d\u5b50\u7ec4\u4ef6\u53d7\u5230\u5f71\u54cd\u3002",
  "discovererName": "Peter Kostiuk of Salesforce.com",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.oracle.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-06100",
  "openTime": "2017-05-09",
  "patchDescription": "Automatic Service Request(ASR)\u662f\u4e00\u6b3e\u53ef\u5728\u53d1\u751f\u5e38\u89c1\u786c\u4ef6\u7ec4\u4ef6\u6545\u969c\u65f6\u63d0\u4f9b\u81ea\u52a8\u6848\u4f8b\u751f\u6210\u7684\u201cOracle\u652f\u6301\u670d\u52a1\u201d\u3002\r\n\r\nOracle Automatic Service Request\u5b58\u5728\u8fdc\u7a0b\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7HTTP\u534f\u8bae\u5229\u7528\u6f0f\u6d1e\u4f7f\u201cASR Manager\u201d\u5b50\u7ec4\u4ef6\u53d7\u5230\u5f71\u54cd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Automatic Service Request\u8fdc\u7a0b\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle Automatic Service Request 4.3.1",
      "Oracle Automatic Service Request 4.3.2"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/97799",
  "serverity": "\u9ad8",
  "submitTime": "2017-04-21",
  "title": "Oracle Automatic Service Request\u8fdc\u7a0b\u6f0f\u6d1e"
}

CVE-2017-3233 (GCVE-0-2017-3233)

Vulnerability from cvelistv5 – Published: 2017-04-24 19:00 – Updated: 2024-10-07 16:23

Summary

Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data.

Assigner

oracle

References

2 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97799	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Automatic Service Request (ASR)	Affected: unspecified , < 5.7 (custom)

Date Public

2017-04-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:16:28.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
          },
          {
            "name": "97799",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97799"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-3233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-07T15:40:30.533643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-07T16:23:15.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Automatic Service Request (ASR)",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThan": "5.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-25T09:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
        },
        {
          "name": "97799",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97799"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2017-3233",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Automatic Service Request (ASR)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
            },
            {
              "name": "97799",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97799"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2017-3233",
    "datePublished": "2017-04-24T19:00:00.000Z",
    "dateReserved": "2016-12-06T00:00:00.000Z",
    "dateUpdated": "2024-10-07T16:23:15.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-06100

CVE-2017-3233 (GCVE-0-2017-3233)

Tags

Sightings

Nomenclature