Vulnerability-Lookup

CNVD-2017-08118

Vulnerability from cnvd - Published: 2017-06-04

Title

Oracle Automatic Service Request本地漏洞（CNVD-2017-08118）

Description

Oracle Automatic Service Request是当硬件出现问题是能快速保存系统状态，具有安全加快诊断过程，自动服务请求生成，优先服务请求处理等功能。 Oracle Automatic Service Request的'ASR Manager'子组件存在本地安全漏洞。攻击者可以利用该漏洞对数据进行非法更新、插入或删除操作，造成部分拒绝服务。

Severity

低

Patch Name

Oracle Automatic Service Request本地漏洞（CNVD-2017-08118）的补丁

Patch Description

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236620.html#AppendixTOOL

Reference

http://www.securityfocus.com/bid/97814 https://nvd.nist.gov/vuln/detail/CVE-2017-3505

Impacted products

Name
['Oracle Automatic Service Request 4.3.1', 'Oracle Automatic Service Request 4.3.2']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97814"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3505",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3505"
    }
  },
  "description": "Oracle Automatic Service Request\u662f\u5f53\u786c\u4ef6\u51fa\u73b0\u95ee\u9898\u662f\u80fd\u5feb\u901f\u4fdd\u5b58\u7cfb\u7edf\u72b6\u6001\uff0c\u5177\u6709\u5b89\u5168\u52a0\u5feb\u8bca\u65ad\u8fc7\u7a0b\uff0c\u81ea\u52a8\u670d\u52a1\u8bf7\u6c42\u751f\u6210\uff0c\u4f18\u5148\u670d\u52a1\u8bf7\u6c42\u5904\u7406\u7b49\u529f\u80fd\u3002\r\n\r\nOracle Automatic Service Request\u7684\u0027ASR Manager\u0027\u5b50\u7ec4\u4ef6\u5b58\u5728\u672c\u5730\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u6570\u636e\u8fdb\u884c\u975e\u6cd5\u66f4\u65b0\u3001\u63d2\u5165\u6216\u5220\u9664\u64cd\u4f5c\uff0c\u9020\u6210\u90e8\u5206\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Peter Kostiuk of Salesforce.com",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttp://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236620.html#AppendixTOOL",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-08118",
  "openTime": "2017-06-04",
  "patchDescription": "Oracle Automatic Service Request\u662f\u5f53\u786c\u4ef6\u51fa\u73b0\u95ee\u9898\u662f\u80fd\u5feb\u901f\u4fdd\u5b58\u7cfb\u7edf\u72b6\u6001\uff0c\u5177\u6709\u5b89\u5168\u52a0\u5feb\u8bca\u65ad\u8fc7\u7a0b\uff0c\u81ea\u52a8\u670d\u52a1\u8bf7\u6c42\u751f\u6210\uff0c\u4f18\u5148\u670d\u52a1\u8bf7\u6c42\u5904\u7406\u7b49\u529f\u80fd\u3002\r\n\r\nOracle Automatic Service Request\u7684\u0027ASR Manager\u0027\u5b50\u7ec4\u4ef6\u5b58\u5728\u672c\u5730\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u6570\u636e\u8fdb\u884c\u975e\u6cd5\u66f4\u65b0\u3001\u63d2\u5165\u6216\u5220\u9664\u64cd\u4f5c\uff0c\u9020\u6210\u90e8\u5206\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Automatic Service Request\u672c\u5730\u6f0f\u6d1e\uff08CNVD-2017-08118\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle Automatic Service Request 4.3.1",
      "Oracle Automatic Service Request 4.3.2"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/97814\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-3505",
  "serverity": "\u4f4e",
  "submitTime": "2017-05-24",
  "title": "Oracle Automatic Service Request\u672c\u5730\u6f0f\u6d1e\uff08CNVD-2017-08118\uff09"
}

CVE-2017-3505 (GCVE-0-2017-3505)

Vulnerability from cvelistv5 – Published: 2017-04-24 19:00 – Updated: 2024-10-07 16:14

Summary

Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR). CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR).

Assigner

oracle

References

2 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97814	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Automatic Service Request (ASR)	Affected: unspecified , < 5.7 (custom)

Date Public

2017-04-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:30:58.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
          },
          {
            "name": "97814",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97814"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-3505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-07T15:45:14.949671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-07T16:14:07.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Automatic Service Request (ASR)",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThan": "5.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily \"exploitable\" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR). CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR).",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-25T09:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
        },
        {
          "name": "97814",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97814"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2017-3505",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Automatic Service Request (ASR)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily \"exploitable\" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR). CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily \"exploitable\" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR)."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
            },
            {
              "name": "97814",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97814"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2017-3505",
    "datePublished": "2017-04-24T19:00:00.000Z",
    "dateReserved": "2016-12-06T00:00:00.000Z",
    "dateUpdated": "2024-10-07T16:14:07.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-08118

CVE-2017-3505 (GCVE-0-2017-3505)

Tags

Sightings

Nomenclature