Medium severity · published Apr 24, 2017
CVE-2017-3567
Vulnerability in the OJVM component of Oracle Database Server
5.3
CVSS
1.5%
EPSS
No
On KEV
Description
Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of OJVM. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Database · Oracle
11.2.0.4; 12.1.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3567
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Third Party Advisory
http://www.securityfocus.com/bid/97873
www.securitytracker.com
http://www.securitytracker.com/id/1038284
More from Database
9.9
CVE-2017-10202
Vulnerability in the OJVM component of Oracle Database Server
9.8
CVE-2020-35169
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability
9.8
CVE-2020-35168
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35167
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35166
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability