Privilege escalation in Oracle Secure Global Desktop - CVE-2016-3613

Vulnerability identifier: #VU175

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3613

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges.

The vulnerability exists in Oracle Secure Global Desktop. A remote user can gain elevated privileges by exploiting a flaw in the Oracle Secure Global Desktop OpenSSL component.

Successful exploitation of this vulnerability may result in user access with elevated privileges on the target system.

Oracle Secure Global Desktop

The vendor has issued a fix as part of the July 2016 Oracle Critical Patch Update.

• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

• Privilege escalation in Oracle Secure Global Desktop