CVE-2018-11055

Published: Aug 31, 2018Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.

Affected (24)

Products: Dell: Bsafe · Oracle: Application Testing Suite, Communications Analytics, Communications Ip Service Activator, Core Rdbms, Enterprise Manager Ops Center, Goldengate Application Adapters, Jd Edwards Enterpriseone Tools, Real User Experience Insight, Retail Predictive Application Server, Security Service, Timesten In Memory Database

Dell

1 product

Bsafe

Oracle

11 products

Application Testing Suite

Communications Analytics

Communications Ip Service Activator

Core Rdbms

Enterprise Manager Ops Center

Goldengate Application Adapters

Jd Edwards Enterpriseone Tools

Real User Experience Insight

Retail Predictive Application Server

Security Service

Timesten In Memory Database

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dell Bsafe	From 4.0.0 to 4.0.11
Dell Bsafe	From 4.1.0 to 4.1.6.1

Configuration B

22 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Communications Analytics	Version 12.1.1
Oracle Communications Ip Service Activator	Version 7.3.0
Oracle Communications Ip Service Activator	Version 7.4.0
Oracle Core Rdbms	Version 11.2.0.4
Oracle Core Rdbms	Version 12.1.0.2
Oracle Core Rdbms	Version 12.2.0.1
Oracle Core Rdbms	Version 18c
Oracle Core Rdbms	Version 19c
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Manager Ops Center	Version 12.4.0
Oracle Goldengate Application Adapters	Version 12.3.2.1.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Real User Experience Insight	Version 13.1.2.1
Oracle Real User Experience Insight	Version 13.2.3.1
Oracle Real User Experience Insight	Version 13.3.1.0
Oracle Retail Predictive Application Server	Version 15.0.3
Oracle Retail Predictive Application Server	Version 16.0.3.0
Oracle Security Service	Version 11.1.1.9.0
Oracle Security Service	Version 12.1.3.0.0
Oracle Security Service	Version 12.2.1.3.0
Oracle Timesten In Memory Database	Before 18.1.4.1.0