Oracle Berkeley DB up to 6.1.37 Data Store access control

Summaryinfo

A vulnerability was found in Oracle Berkeley DB up to 6.1.37 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Data Store. Executing a manipulation can lead to Local Privilege Escalation. This vulnerability is tracked as CVE-2017-10140. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Oracle Berkeley DB up to 6.1.37 (Software Library). It has been declared as critical. This vulnerability affects an unknown code of the component Data Store. The manipulation with an unknown input leads to a local privilege escalation vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 07/15/2020 as Oracle Critical Patch Update Advisory - July 2020 as confirmed advisory (Website). The advisory is shared for download at oracle.com. This vulnerability was named CVE-2017-10140. The attack needs to be approached locally. A single authentication is needed for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 220439 (Linux Distros Unpatched Vulnerability : CVE-2017-10140), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370625 (Apple macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan Not Installed).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (220439). The entries VDB-116264, VDB-158073, VDB-158074 and VDB-158075 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Oracle

Name

• Berkeley DB

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.1.23
• 6.1.24
• 6.1.25
• 6.1.26
• 6.1.27
• 6.1.28
• 6.1.29
• 6.1.30
• 6.1.31
• 6.1.32
• 6.1.33
• 6.1.34
• 6.1.35
• 6.1.36
• 6.1.37

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion