SB2024041717 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024041717

SB2024041717 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function

Published: April 17, 2024

Security Bulletin ID SB2024041717
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2023-2283)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error within the pki_verify_data_signature() function in pki_crypto.c. The pki_key_check_hash_compatible() function can return SSH_OK value if memory allocation error happens later in the function. The  A remote attacker can bypass authentication process and gain unauthorized access to the system.


2) Incorrect default permissions (CVE-ID: CVE-2023-43496)

The vulnerability allows a local user to execute arbitrary code on the system.

The vulnerability exists due to the affected plugin creates the temporary file in the system temporary directory with the default permissions for newly created files. A local user can view contents of files and directories and execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References