Main Vulnerability Database Vulnerabilities #VU28583

Improper input validation in Oracle Utilities Framework - CVE-2014-3004

Published: June 4, 2020 / Updated: June 19, 2020

Vulnerability identifier: #VU28583

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-3004

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Common (Castor) component in Oracle Utilities Framework. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Affected software

Oracle Utilities Framework
IBM Business Process Manager
Netcool Operations Insight
IBM Business Automation Workflow
IBM Tivoli Application Dependency Discovery Manager
Fedora
castor

How to mitigate CVE-2014-3004

Install updates from vendor's website.

Oracle Utilities Framework - addressed in versions 4.2.0.3.0, 4.3.0.5.0
castor - update to 1.3.3-1.fc21
Netcool Operations Insight - update to 1.6.8
IBM Business Automation Workflow - addressed in versions 20.0.0.2, 21.0.3, 21.0.3 IF014, 22.0.1, 22.0.1 IF003

Links to Public Exploits and PoC-codes

Exploit #3049 - Castor Library - XML External Entity Information Disclosure (June 19, 2020)

External References

https://www.oracle.com/security-alerts/cpujan2020.html