CVE-2017-5645 in Oracle Identity Manager Connector

Summary

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Reservation

01/29/2017

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
163173	Oracle Identity Manager Connector General/Misc deserialization	502	Not defined	Official fix	CVE-2017-5645
163123	Oracle Financial Services Regulatory Reporting with AgileREPORTER deserialization	502	Not defined	Official fix	CVE-2017-5645
163005	Oracle TimesTen In-Memory Database Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
158468	Oracle Rapid Planning Middle Tier deserialization	502	Not defined	Official fix	CVE-2017-5645
158467	Oracle Rapid Planning Middle Tier deserialization	502	Not defined	Official fix	CVE-2017-5645
158418	Oracle Retail Service Backbone Installer deserialization	502	Not defined	Official fix	CVE-2017-5645
158412	Oracle Retail Extract Transform/Load Mathematical Operators deserialization	502	Not defined	Official fix	CVE-2017-5645
158279	Oracle WebLogic Server Console deserialization	502	Not defined	Official fix	CVE-2017-5645
158278	Oracle WebLogic Server Centralized Thirdparty Jars deserialization	502	Not defined	Official fix	CVE-2017-5645
158270	Oracle Endeca Information Discovery Studio deserialization	502	Not defined	Official fix	CVE-2017-5645
158231	Oracle Financial Services Lending/Leasing Core deserialization	502	Not defined	Official fix	CVE-2017-5645
158215	Oracle Application Testing Suite Load Testing for Web Apps deserialization	502	Not defined	Official fix	CVE-2017-5645
158164	Oracle Primavera Gateway Admin deserialization	502	Not defined	Official fix	CVE-2017-5645
158118	Oracle Communications Network Integrity Cartridge Management deserialization	502	Not defined	Official fix	CVE-2017-5645
153651	Oracle In-Memory Performance-Driven Planning User deserialization	502	Not defined	Official fix	CVE-2017-5645
153623	Oracle Retail Advanced Inventory Planning AIP Dashboard deserialization	502	Not defined	Official fix	CVE-2017-5645
153339	Oracle Instantis EnterpriseTrack Logging deserialization	502	Not defined	Official fix	CVE-2017-5645
148696	Oracle Communications Instant Messaging Server deserialization	502	Not defined	Official fix	CVE-2017-5645
143676	Oracle JD Edwards EnterpriseOne Tools Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
138164	Oracle Utilities Advanced Spatial/Operational Analytics Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
138053	Oracle JD Edwards EnterpriseOne Tools Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
137997	Oracle SOA Suite CKEditor deserialization	502	Not defined	Official fix	CVE-2017-5645
137880	Oracle Interactive Session Recorder Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
133650	Oracle JD Edwards EnterpriseOne Tools Monitoring/Diagnostics deserialization	502	Not defined	Official fix	CVE-2017-5645
133591	Oracle JDeveloper Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
133493	Oracle Communications Pricing Design Center Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
129688	Oracle Tape Library ACSLS Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
129538	Oracle SOA Suite Apache Batik deserialization	502	Not defined	Official fix	CVE-2017-5645
129536	Oracle GoldenGate Application Adapters Spring deserialization	502	Not defined	Official fix	CVE-2017-5645
129522	Oracle FLEXCUBE Investor Servicing jQuery deserialization	502	Not defined	Official fix	CVE-2017-5645
129463	Oracle Communications WebRTC Session Controller Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
129460	Oracle Communications Service Broker Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
129458	Oracle Communications Online Mediation Controller Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
129456	Oracle Communications Converged Application Server Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125624	Oracle Siebel CRM UI deserialization	502	Not defined	Official fix	CVE-2017-5645
125599	Oracle Retail Open Commerce Platform Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125597	Oracle Retail Extract Transform/Load Mathematical Operators deserialization	502	Not defined	Official fix	CVE-2017-5645
125510	Oracle Insurance Rules Palette deserialization	502	Not defined	Official fix	CVE-2017-5645
125508	Oracle Insurance Calculation Engine deserialization	502	Not defined	Official fix	CVE-2017-5645
125428	Oracle Identity Management Suite Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125427	Oracle Identity Analytics Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125424	Oracle API Gateway Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125423	Oracle BI Publisher Apache Log4j deserialization	502	Not defined	Official fix	CVE-2017-5645
125414	Oracle Configuration Manager Collector of Config/Diag deserialization	502	Not defined	Official fix	CVE-2017-5645
125374	Oracle Communications Messaging Server Convergence deserialization	502	Not defined	Official fix	CVE-2017-5645
121885	Oracle Utilities Work/Asset Management Logging deserialization	502	Not defined	Official fix	CVE-2017-5645
121884	Oracle Utilities Network Management System Logging deserialization	502	Not defined	Official fix	CVE-2017-5645
121875	Oracle AutoVue VueLink Integration Installation deserialization	502	Not defined	Official fix	CVE-2017-5645
121833	Oracle Retail Service Layer Installation deserialization	502	Not defined	Official fix	CVE-2017-5645
121832	Oracle Retail Service Backbone Install deserialization	502	Not defined	Official fix	CVE-2017-5645

79 More entries are not shown