Privilege escalation in Oracle Financial Services Software

1) Privilege escalation

EUVDB-ID: #VU1049

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-5607

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain elevated privileges on the target system.
The weakness is caused by a flaw in the Oracle FLEXCUBE Universal Banking INFRA component and lets attacker increase his privileges.
Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Vulnerable software versions

Oracle Financial Services Software: 11.3.0 - 12.2.0

Oracle FLEXCUBE Universal Banking: 11.3.0 - 12.2.0

CPE2.3

• cpe:2.3:a:oracle:oracle_financial_services_software:11.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_financial_services_software:11.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_financial_services_software:12.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*

External links

https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixIFLX
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.