Oracle Business Intelligence Publisher Multiple Vulnerabilities (July 2018 CPU)

2018-12-28T00:00:00
ID ORACLE_BI_PUBLISHER_JUL_2018_CPU.NASL
Type nessus
Reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2020-02-02T00:00:00

Description

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.180717 or 11.1.1.9.x prior to 11.1.1.9.180717, similarly, versions 12.2.1.2.x prior to 12.2.1.2.180717 and 12.2.1.3.x prior to 12.2.1.3.180717 are affected as noted in the July 2018 Critical Patch Update advisory. The Oracle Business Intelligence Publisher installed on the remote host is affected by multiple vulnerabilities:

  • A vulnerability exists on the Layout Tools, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker can exploit the vulnerability via HTTP access to compromise BI Publisher. A successful attack could result in an unauthorized creation, deletion or modification of critical data on BI Publisher including read data to a subset of information (CVE-2018-2900).

  • A vulnerability exists on the Web Server, Oracle BI Publisher component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can easily exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2925).

  • A vulnerability exists on the BI Publisher Security, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2958).

Note that Nessus has not tested for these issues but has instead relied only on the application

                                        
                                            #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(119940);
  script_version("1.3");
  script_cvs_date("Date: 2019/10/31 15:18:52");

  script_cve_id("CVE-2018-2900", "CVE-2018-2925", "CVE-2018-2958");
  script_bugtraq_id(104767);

  script_name(english:"Oracle Business Intelligence Publisher Multiple Vulnerabilities (July 2018 CPU)");
  script_summary(english:"Checks for applied patches.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Oracle Business Intelligence Publisher running on the
remote host is 11.1.1.7.x prior to 11.1.1.7.180717 or 11.1.1.9.x 
prior to 11.1.1.9.180717, similarly, versions  12.2.1.2.x prior to
12.2.1.2.180717 and 12.2.1.3.x prior to 12.2.1.3.180717 are affected 
as noted in the July 2018 Critical Patch Update advisory. 
The Oracle Business Intelligence Publisher installed on the remote
host is affected by multiple vulnerabilities:

  - A vulnerability exists on the Layout Tools, Oracle BI
    Publisher component of Oracle Fusion Middleware. An
    unauthenticated attacker can exploit the vulnerability
    via HTTP access to compromise BI Publisher. A
    successful attack could result in an unauthorized
    creation, deletion or modification of critical data on
    BI Publisher including read data to a subset of
    information (CVE-2018-2900).

  - A vulnerability exists on the Web Server, Oracle BI
    Publisher component of Oracle Fusion Middleware. A low
    privileged attacker with network access via HTTP can
    easily exploit the vulnerability to compromise Oracle
    BI Publisher. Unauthorized access to critical data
    hosted in the remote server can be possible after a
    successful exploit of the vulnerability
    (CVE-2018-2925).

  - A vulnerability exists on the BI Publisher Security,
    Oracle BI Publisher component of Oracle Fusion
    Middleware. An unauthenticated attacker with network
    access via HTTP can exploit the vulnerability to
    compromise Oracle BI Publisher. Unauthorized access to
    critical data hosted in the remote server can be
    possible after a successful exploit of the
    vulnerability (CVE-2018-2958).
  
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d0716163");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the July 2018 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-2958");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:business_intelligence_publisher");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_bi_publisher_installed.nbin", "oracle_bi_publisher_detect.nasl");
  script_require_keys("installed_sw/Oracle Business Intelligence Publisher");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');
appname = 'Oracle Business Intelligence Publisher';
app_info = vcf::get_app_info(app:appname);

# 11.1.1.7.x - Bundle: 28119130 | Patch: 27916893
# 11.1.1.9.x - Bundle: 28119112 | Patch: 27982217
# 12.2.1.2.x - Bundle: 27916905 | Patch: 27916905
# 12.2.1.3.x - Bundle: 27329720 | Patch: 27329720
constraints = [
  {'min_version': '11.1.1.7', 'fixed_version': '11.1.1.7.180717', 'patch': '27916893', 'bundle': '28119130'},
  {'min_version': '11.1.1.9', 'fixed_version': '11.1.1.9.180717', 'patch': '27982217', 'bundle': '28119112'},
  {'min_version': '12.2.1.2', 'fixed_version': '12.2.1.2.180717', 'patch': '27916905', 'bundle': '27916905'},
  {'min_version': '12.2.1.3', 'fixed_version': '12.2.1.3.180717', 'patch': '27329720', 'bundle': '27329720'}
];

vcf::oracle_bi_publisher::check_version_and_report(app_info: app_info, constraints:constraints, severity:SECURITY_WARNING);