Twenty Year Anniversary

Oracle Outside In 8.5.3 Heap-Based Buffer Overflows / OOB Write

Oracle Outside In 8.5.3 Heap-Based Buffer Overflows / OOB Write
Posted Jul 20, 2018
Authored by Behzad Najjarpour Jabbari | Site secunia.com

Secunia Research has discovered multiple vulnerabilities in Oracle Outside In Technology, which can be exploited by malicious people to compromise a vulnerable system. An error within the "VwStreamRead()" function (vsdrw.dll) can be exploited to cause a heap-based buffer overflow. A boundary error in the vsxl5.dll can be exploited to cause a heap-based buffer overflow. Another boundary error in the vsxl5.dll can be exploited to cause a heap-based buffer overflow. An integer underflow error within the "VwStreamOpen()" function (vswk6.dll) can be exploited to cause an out-of-bounds write memory access. The vulnerabilities are confirmed in version 8.5.3. Other versions may also be affected.

tags | advisory, overflow, vulnerability
advisories | CVE-2018-3010, CVE-2018-3092, CVE-2018-3099, CVE-2018-3102
MD5 | be326e466eb0e8b495861d5e98f468e7

Oracle Outside In 8.5.3 Heap-Based Buffer Overflows / OOB Write

Change Mirror Download
======================================================================

Secunia Research 2018/07/20

Oracle Outside In Technology Multiple Vulnerabilities

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerabilities.......................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Flexera Software...............................................8
Verification.........................................................9

======================================================================
1) Affected Software

* Oracle Outside In Technology version 8.5.3.

======================================================================
2) Severity

Rating: Highly critical
Impact: System Access
Where: Remote

======================================================================
3) Description of Vulnerabilities

Secunia Research has discovered multiple vulnerabilities in
Oracle Outside In Technology, which can be exploited by malicious
people to compromise a vulnerable system.

1) An error within the "VwStreamRead()" function (vsdrw.dll) can be
exploited to cause a heap-based buffer overflow.

2) A boundary error in the vsxl5.dll can be exploited to cause a
heap-based buffer overflow.

3) Another boundary error in the vsxl5.dll can be exploited to cause
a heap-based buffer overflow.

4) An integer underflow error within the "VwStreamOpen()" function
(vswk6.dll) can be exploited to cause an out-of-bounds write memory
access.

The vulnerabilities are confirmed in version 8.5.3. Other versions may
also be affected.

======================================================================
4) Solution

Apply update.
https://support.oracle.com/rs?type=doc&id=2394520.1

======================================================================
5) Time Table

2018/03/26 Vendor notified about vulnerabilities.
2018/03/29 Vendor supplied bug ticket ID.
2018-05-25 Vendor status update.
2018-06-06 Vendor asks for additional details.
2018-06-06 Vendor is provided with further analysis of the
vulnerabilities.
2018-06-26 - Vendor supplies information on fix in main codeline.
2018/07/17 - Release of vendor patch.
2018/07/18 - Release of Secunia Advisory SA81459.
2018/07/20 - Public disclosure of Secunia Research Advisory.

======================================================================
6) Credits

Behzad Najjarpour Jabbari, Secunia Research at Flexera

======================================================================
7) References

The Common Vulnerabilities and Exposures (CVE) project has
assigned the CVE-2018-3102, CVE-2018-3010, CVE-2018-3092, and
CVE-2018-3099 identifier for the vulnerabilities.

======================================================================
8) About Flexera

Flexera helps application producers and enterprises increase
application usage and the value they derive from their software.

http://www.flexera.com

Flexera delivers market-leading Software Vulnerability Management
solutions enabling enterprises to proactively identify and
remediate software vulnerabilities, effectively reducing the risk of
costly security breaches.

https://www.flexera.com/enterprise/products/

Flexera supports and contributes to the community in several
ways. We have always believed that reliable vulnerability
intelligence and tools to aid identifying and fixing vulnerabilities
should be freely available for consumers to ensure that users,
who care about their online privacy and security, can stay secure.
Only a few vendors address vulnerabilities in a proper way and help
users get updated and stay secure. End-users (whether private
individuals or businesses) are otherwise left largely alone, and
that is why back in 2002, Secunia Research started investigating,
coordinating disclosure and verifying software vulnerabilities.
In 2016, Secunia Research became a part of Flexera and today
our in-house software vulnerability research remains the core of
the Software Vulnerability Management products at Flexera.

https://www.flexera.com/enterprise/company/about/secunia-research/

The public Secunia Advisory database contains information for
researchers, security enthusiasts, and consumers to lookup individual
products and vulnerabilities and assess, whether they need to take
any actions to secure their systems or whether a given vulnerability
has already been discovered.

https://secuniaresearch.flexerasoftware.com/community/advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-15/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    1 Files
  • 3
    Dec 3rd
    18 Files
  • 4
    Dec 4th
    40 Files
  • 5
    Dec 5th
    16 Files
  • 6
    Dec 6th
    50 Files
  • 7
    Dec 7th
    12 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    15 Files
  • 11
    Dec 11th
    30 Files
  • 12
    Dec 12th
    25 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close