Security restrictions bypass in Oracle products - CVE-2018-2783

Vulnerability identifier: #VU11946

CSH Severity: Low

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-2783

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE due to improper security restrictions. A remote attacker can create, delete or modify critical data or all Java SE, Java SE Embedded, JRockit accessible data and gain unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data.

JRockit
IBM Cognos Business Intelligence Server
Oracle Java SE
Java SE Embedded
IBM Algo Credit Manager
IBM Cognos Command Center
IBM AIX
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Satellite
IBM Tivoli System Automation Application Manager
Cognos Insight
FlashSystem 840 9840-AE1 & 9843-AE1
FlashSystem 900 9843-UF3
Tivoli System Automation for Multiplatforms
IBM Tivoli Netcool Configuration Manager
Virtualization Engine TS7700 3957-V07
Virtualization Engine TS7700 3957-VEB
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 900 9840-AE3 and 9843-AE3
SAN Volume Controller and Storwize Family
Virtualization Engine TS7700 3957-VEC

Install update from vendor's website.

FlashSystem 840 9840-AE1 & 9843-AE1 - addressed in versions 1.5.2.5, 1.6.1.0
FlashSystem 900 9843-UF3 - addressed in versions 1.5.2.5, 1.6.1.0
FlashSystem 900 9840-AE2 and 9843-AE2 - addressed in versions 1.5.2.5, 1.6.1.0
FlashSystem 900 9840-AE3 and 9843-AE3 - addressed in versions 1.5.2.5, 1.6.1.0
IBM Tivoli System Automation Application Manager - update to 4.1.0.1.0.8
Tivoli System Automation for Multiplatforms - addressed in versions 4.1.0.3.0.5, 4.1.0.4.0.2
IBM Tivoli Netcool Configuration Manager - addressed in versions 6.4.1.4.0.8, 6.4.2.6.0.1
SAN Volume Controller and Storwize Family - addressed in versions 7.8.1.8, 8.1.3.3, 8.2.0.0, 8.2.1.0
Virtualization Engine TS7700 3957-V07 - addressed in versions 8.33.3.14 VTD_EXEC.269, 8.40.2.12 VTD_EXEC.269, 8.41.101.10 VTD_EXEC.269, 8.41.200.113 VTD_EXEC.269
Virtualization Engine TS7700 3957-VEB - addressed in versions 8.33.3.14 VTD_EXEC.269, 8.40.2.12 VTD_EXEC.269, 8.41.101.10 VTD_EXEC.269, 8.41.200.113 VTD_EXEC.269
Virtualization Engine TS7700 3957-VEC - addressed in versions 8.40.2.12 VTD_EXEC.269, 8.41.101.10 VTD_EXEC.269, 8.41.200.113 VTD_EXEC.269

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

• Multiple vulnerabilities in Oracle Java SE
• Red Hat update for Oracle Java SE
• Red Hat update for Oracle Java SE
• Red Hat update for Oracle Java SE
• Red Hat update for Oracle Java SE
• Red Hat update for Oracle Java SE
• Red Hat update for Oracle Java SE
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM AIX
• Security restrictions bypass in IBM Algo Credit Manager
• Red Hat update for java-se
• Red Hat update for java-se
• Multiple vulnerabilities in IBM Cognos Insight
• Multiple vulnerabilities in IBM Cognos Business Intelligence Server
• Security restrictions bypass in IBM Tivoli System Automation for Multiplatforms
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM FlashSystem models 840 and 900
• Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
• Multiple vulnerabilities in IBM Virtualization Engine TS7700