Summaryinfo

A vulnerability has been found in Oracle Communications Application Session Controller up to 3.7.0 and classified as very critical. The affected element is an unknown function of the component Glibc. Performing a manipulation results in memory corruption (Ghost). This vulnerability was named CVE-2015-0235. The attack may be initiated remotely. In addition, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Oracle Communications Application Session Controller up to 3.7.0 (Cloud Software). This affects an unknown part of the component Glibc. The manipulation with an unknown input leads to a memory corruption vulnerability (Ghost). CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 10/16/2018 as Oracle Critical Patch Update Advisory - October 2018 as confirmed advisory (Website). The advisory is shared at oracle.com. This vulnerability is uniquely identified as CVE-2015-0235. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/31/2024).

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 82122 (Debian DLA-139-1 : eglibc security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 124172 (Apple Mac OS X v10.11.1 Not Installed (APPLE-SA-2015-10-21-4)).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (35951), Tenable (82122), SecurityFocus (BID 72325†) and Secunia (SA62758†). See VDB-68857, VDB-74877, VDB-74936 and VDB-78625 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Oracle

Name

• Communications Application Session Controller

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion