CVE-2017-10166: Medium severity oracle security service vulnerability

Published Oct 19, 2017

Updated

Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: C Oracle SSL API). Supported versions that are affected are FMW: 11.1.1.9.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Security Service accessible data. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected Software

2 affected components

Oracle Security Service=12.1.3.0.0

ORACLE Security Service Fmw=11.1.1.9.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10166?

CVE-2017-10166 is classified as a difficult to exploit vulnerability that allows unauthenticated attackers with network access to compromise systems.

How do I fix CVE-2017-10166?

To address CVE-2017-10166, it is recommended to apply the latest patches provided by Oracle for affected versions 11.1.1.9.0 and 12.1.3.0.0.

What systems are affected by CVE-2017-10166?

CVE-2017-10166 affects Oracle Fusion Middleware versions 11.1.1.9.0 and 12.1.3.0.0 specifically within the Oracle Security Service component.

Can CVE-2017-10166 be exploited remotely?

Yes, CVE-2017-10166 can be exploited remotely by unauthenticated attackers with network access via HTTPS.

What impact does CVE-2017-10166 have on organizations?

Organizations vulnerable to CVE-2017-10166 may face unauthorized access and potential compromise of their Oracle Fusion Middleware applications.