Microsoft update for Oracle Fusion Middleware
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-2768 CVE-2018-2806 CVE-2018-2801 |
| CWE-ID | CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Microsoft Exchange Server Server applications / Mail servers |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Security restrictions bypass
EUVDB-ID: #VU11924
Risk: Low
CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-2768
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and cause DoS condition on the target system.
The weakness exists in the Oracle Outside In Technology component of Oracle Fusion Middleware due to improper security restrictions. A remote attacker can trick the victim into opening a specially crafted file, gain unauthorized access to critical data or complete access to all Oracle Security Service accessible data and partially cause the service to crash.
Install updates from Microsoft website.
Vulnerable software versionsMicrosoft Exchange Server: 2010 - 2016 RTM 15.01.0225.042
CPE2.3- cpe:2.3:a:microsoft:microsoft_exchange_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_exchange_server:2013_RTM:15.00.0516.032:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_exchange_server:2016_RTM:15.01.0225.042:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180010
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Security restrictions bypass
EUVDB-ID: #VU11928
Risk: Low
CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-2806
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and cause DoS condition on the target system.
The weakness exists in the Oracle Outside In Technology component of Oracle Fusion Middleware due to improper security restrictions. A remote attacker can trick the victim into opening a specially crafted file, gain unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and partially cause the service to crash.
Install updates from Microsoft website.
Vulnerable software versionsMicrosoft Exchange Server: 2010 - 2016 RTM 15.01.0225.042
CPE2.3https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180010
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Security restrictions bypass
EUVDB-ID: #VU11927
Risk: Low
CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-2801
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and cause DoS condition on the target system.
The weakness exists in the Oracle Outside In Technology component of Oracle Fusion Middleware due to improper security restrictions. A remote attacker can trick the victim into opening a specially crafted file, gain unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and partially cause the service to crash.
Install updates from Microsoft website.
Vulnerable software versionsMicrosoft Exchange Server: 2010 - 2016 RTM 15.01.0225.042
CPE2.3https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180010
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
