SB2020042359 - Multiple vulnerabilities in Oracle Retail Xstore Point of Service
Published: April 23, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2018-11797)
The vulnerability vulnerability allows an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a target system.
The vulnerability exists in the Apache PDFBox parser due to improper processing of PDF files when parsing the page tree. A remote attacker can trick the victim into opening a PDF file that submits malicious input to the targeted system, trigger an infinite loop condition, which could lead to an out-of-memory exception and result in a DoS condition.
2) Use-after-free (CVE-ID: CVE-2019-10082)
The vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the mod_http2 when handling connection shutdown. A remote attacker can send specially crafted requests to the affected server and make the mod_http2 to read memory that was already freed.
3) Stored cross-site scripting (CVE-ID: CVE-2018-12581)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within Designer feature. A remote attacker create database with a specially crafted name and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Resource management error (CVE-ID: CVE-2019-10072)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incomplete fix for SB2019020812 when processing HTTP/2 requests. A remote attacker can perform denial of service attack by not sending WINDOW_UPDATE messages for the connection window (stream 0).
5) Protection mechanism failure (CVE-ID: CVE-2019-10086)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exist due to Beanutils is not using by default the a special BeanIntrospector class in PropertyUtilsBean that was supposed to suppress the ability for an attacker to access the classloader via the class property available on all Java objects. A remote attacker can abuse such application behavior against applications that were developed to rely on this security feature.
6) Deserialization of Untrusted Data (CVE-ID: CVE-2019-10173)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data passed in XML or JSON formats within the xstream API. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Improper input validation (CVE-ID: CVE-2017-3160)
The vulnerability allows a local authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Xstore Services (Apache Cordova) component in Oracle Retail Xstore Point of Service. A local authenticated user can exploit this vulnerability to read and manipulate data.
8) Uncontrolled memory allocation (CVE-ID: CVE-2018-10237)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to unbounded memory allocation. A remote attacker can cause the service to crash and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
9) Infinite loop (CVE-ID: CVE-2017-12626)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to infinite loops while parsing specially crafted WMF, EMF, MSG and macros and out of Memory exceptions while parsing specially crafted DOC, PPT and XLS. A remote attacker can cause the service to crash.
10) Memory leak (CVE-ID: CVE-2019-17359)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the ASN.1 parser. A remote attacker can send a specially crafted ASN.1 data and cause an OutOfMemoryError and perform denial of service attack.
11) Improper input validation (CVE-ID: CVE-2019-0227)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (Apache Axis) component in Oracle Communications Design Studio. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
12) Improper input validation (CVE-ID: CVE-2017-5533)
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Point of Sale (JasperReports) component in Oracle Retail Xstore Point of Service. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
Remediation
Install update from vendor's website.