Vulnerabilities > CVE-2016-5497 - Improper Access Control vulnerability in Oracle Database 12.1.0.2

047910
CVSS 6.4 - MEDIUM
Attack vector
LOCAL
Attack complexity
HIGH
Privileges required
HIGH
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
high complexity
oracle
CWE-284
nessus
NVD
Published: 2016-10-25
Updated: 2024-11-21

Summary

Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

Vulnerable Configurations

Part Description Count
Application
Oracle
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

NASL familyDatabases
NASL idORACLE_RDBMS_CPU_OCT_2016.NASL
descriptionThe remote Oracle Database Server is missing the October 2016 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the RDBMS Security and SQL*Plus component that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2016-3562) - An unspecified flaw exists in the RDBMS Security component that allows a local attacker to gain elevated privileges. (CVE-2016-5497) - Multiple unspecified flaws exist in the RDBMS Security component that allow a local attacker to disclose sensitive information. (CVE-2016-5498, CVE-2016-5499) - An unspecified flaw exists in the RDBMS Programmable Interface component that allows a local attacker to disclose sensitive information. (CVE-2016-5505) - An unspecified flaw exists in the Kernel PDB component that allows a local attacker to cause a denial of service condition. (CVE-2016-5516) - An unspecified flaw exists in the OJVM component that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2016-5555) - An unspecified flaw exists in the Kernel PDB component that allows a local attacker to gain elevated privileges. (CVE-2016-5572)
last seen2020-06-02
modified2016-10-21
plugin id94201
published2016-10-21
reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/94201
titleOracle Database Multiple Vulnerabilities (October 2016 CPU)
code
#
# (C) Tenable Network Security, Inc.
#




include("compat.inc");

if (description)
{
  script_id(94201);
  script_version("1.15");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");

  script_cve_id(
    "CVE-2016-3562",
    "CVE-2016-5497",
    "CVE-2016-5498",
    "CVE-2016-5499",
    "CVE-2016-5505",
    "CVE-2016-5516",
    "CVE-2016-5555",
    "CVE-2016-5572"
  );
  script_bugtraq_id(
    93613,
    93615,
    93620,
    93626,
    93629,
    93631,
    93634,
    93640
  );

  script_name(english:"Oracle Database Multiple Vulnerabilities (October 2016 CPU)");
  script_summary(english:"Checks the installed patch info.");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Database Server is missing the October 2016 Critical
Patch Update (CPU). It is, therefore, affected by multiple
vulnerabilities :

  - An unspecified flaw exists in the RDBMS Security and
    SQL*Plus component that allows an authenticated, remote
    attacker to disclose sensitive information.
    (CVE-2016-3562)

  - An unspecified flaw exists in the RDBMS Security
    component that allows a local attacker to gain elevated
    privileges. (CVE-2016-5497)

  - Multiple unspecified flaws exist in the RDBMS Security
    component that allow a local attacker to disclose
    sensitive information. (CVE-2016-5498, CVE-2016-5499)

  - An unspecified flaw exists in the RDBMS Programmable
    Interface component that allows a local attacker to
    disclose sensitive information. (CVE-2016-5505)

  - An unspecified flaw exists in the Kernel PDB component
    that allows a local attacker to cause a denial of
    service condition. (CVE-2016-5516)

  - An unspecified flaw exists in the OJVM component that
    allows an authenticated, remote attacker to execute
    arbitrary code. (CVE-2016-5555)

  - An unspecified flaw exists in the Kernel PDB component
    that allows a local attacker to gain elevated
    privileges. (CVE-2016-5572)");
  # http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bac902d5");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the October 2016 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-5555");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/10/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/10/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/21");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"agent", value:"all");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include("oracle_rdbms_cpu_func.inc");

################################################################################
# OCT2016
patches = make_nested_array();

# RDBMS 12.1.0.2
patches["12.1.0.2"]["db"]["nix"] = make_array("patch_level", "12.1.0.2.161018", "CPU", "24006101, 24448103");
patches["12.1.0.2"]["db"]["win"] = make_array("patch_level", "12.1.0.2.161018", "CPU", "24591642");
# RDBMS 11.2.0.4 #
patches["11.2.0.4"]["db"]["nix"] = make_array("patch_level", "11.2.0.4.161018", "CPU", "24433711, 24006111");
patches["11.2.0.4"]["db"]["win"] = make_array("patch_level", "11.2.0.4.161018", "CPU", "24591646");

# JVM 12.1.0.2
patches["12.1.0.2"]["ojvm"]["nix"] = make_array("patch_level", "12.1.0.2.161018", "CPU", "24315824");
patches["12.1.0.2"]["ojvm"]["win"] = make_array("patch_level", "12.1.0.2.161018", "CPU", "24591630");
# JVM 11.2.0.4
patches["11.2.0.4"]["ojvm"]["nix"] = make_array("patch_level", "11.2.0.4.161018", "CPU", "24315821");
patches["11.2.0.4"]["ojvm"]["win"] = make_array("patch_level", "11.2.0.4.161018", "CPU", "24591637");

check_oracle_database(patches:patches);

References