Oracle GoldenGate 12.1.2.1.0/12.2.0.2.0/12.3.0.1.0 Manager null pointer dereference
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.4 | $0-$5k | 0.00 |
Summary
A vulnerability, which was classified as critical, was found in Oracle GoldenGate 12.1.2.1.0/12.2.0.2.0/12.3.0.1.0. Impacted is an unknown function of the component Manager. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2018-2914. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.
Details
A vulnerability, which was classified as critical, has been found in Oracle GoldenGate 12.1.2.1.0/12.2.0.2.0/12.3.0.1.0. Affected by this issue is some unknown functionality of the component Manager. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability.
The bug was discovered 10/16/2018. The weakness was disclosed 10/16/2018 by Jacob Baines as Oracle Critical Patch Update Advisory - October 2018 as confirmed advisory (Website). The advisory is shared for download at oracle.com. This vulnerability is handled as CVE-2018-2914 since 12/15/2017. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.
Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 105651†). The entries VDB-90449, VDB-91385, VDB-91680 and VDB-91681 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Vendor
Name
Version
License
Website
- Vendor: https://www.oracle.com
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.5VulDB Meta Temp Score: 7.4
VulDB Base Score: 7.5
VulDB Temp Score: 7.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
Vendor Base Score (Oracle): 7.5
Vendor Vector (Oracle): 🔍
NVD Base Score: 7.5
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Null pointer dereferenceCWE: CWE-476 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Timeline
12/15/2017 🔍10/16/2018 🔍
10/16/2018 🔍
10/16/2018 🔍
10/16/2018 🔍
10/17/2018 🔍
10/17/2018 🔍
05/25/2023 🔍
Sources
Vendor: oracle.comAdvisory: Oracle Critical Patch Update Advisory - October 2018
Researcher: Jacob Baines
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2018-2914 (🔍)
GCVE (CVE): GCVE-0-2018-2914
GCVE (VulDB): GCVE-100-125372
SecurityFocus: 105651 - Oracle GoldenGate Multiple Remote Security Vulnerabilities
See also: 🔍
Entry
Created: 10/17/2018 08:40Updated: 05/25/2023 15:59
Changes: 10/17/2018 08:40 (70), 04/02/2020 16:55 (6), 05/25/2023 15:59 (4)
Complete: 🔍
Cache ID: 216:01C:103
No comments yet. Languages: en.
Please log in to comment.