NCSC | Beveiligingsadviezen
Bekijk RSS-feed

Beveiligingsadviezen

Download

Beveilingsadvies; NCSC-2025-0124 [1.0.0]

Beveiligingsadvies
NCSC-2025-0124 [1.0.0]
Publicatie
16-04-2025 10:39 (Europe/Amsterdam)
Prioriteit
Normaal
Betreft
Kwetsbaarheden verholpen in Oracle Communications

Kenmerken

  • Path Equivalence: 'file.name' (Internal Dot)
  • Use of Incorrectly-Resolved Name or Reference
  • Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  • Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
  • Deserialization of Untrusted Data
  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • Stack-based Buffer Overflow
  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Dependency on Vulnerable Third-Party Component
  • Improper Isolation or Compartmentalization
  • Always-Incorrect Control Flow Implementation
  • Use of Potentially Dangerous Function
  • Improper Neutralization of Special Elements Used in a Template Engine
  • Missing Report of Error Condition
  • Missing Release of Resource after Effective Lifetime
  • Observable Timing Discrepancy
  • Incorrect Resource Transfer Between Spheres
  • Acceptance of Extraneous Untrusted Data With Trusted Data
  • Excessive Iteration
  • Incorrect Implementation of Authentication Algorithm
  • Incorrect Permission Assignment for Critical Resource
  • Time-of-check Time-of-use (TOCTOU) Race Condition
  • Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
  • Improper Validation of Syntactic Correctness of Input
  • Improper Check for Unusual or Exceptional Conditions
  • Integer Overflow to Buffer Overflow
  • Insufficient Verification of Data Authenticity
  • Divide By Zero
  • Files or Directories Accessible to External Parties
  • Authorization Bypass Through User-Controlled Key
  • Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • Improper Resource Shutdown or Release
  • Missing Authorization
  • Improper Restriction of Operations within the Bounds of a Memory Buffer
  • Inefficient Regular Expression Complexity
  • Improper Certificate Validation
  • Improper Control of Generation of Code ('Code Injection')
  • Use of a Broken or Risky Cryptographic Algorithm
  • Uncontrolled Resource Consumption
  • Allocation of Resources Without Limits or Throttling
  • Uncontrolled Recursion
  • Improper Restriction of XML External Entity Reference
  • Exposure of Sensitive Information to an Unauthorized Actor
  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • Improper Privilege Management
  • Improper Input Validation

Omschrijving

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.

De kwetsbaarheden in Oracle Communications producten stellen ongeauthenticeerde aanvallers in staat om ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens en kunnen leiden tot Denial-of-Service (DoS) aanvallen. Specifieke versies van de Cloud Native Core, zoals de Binding Support Function en Network Repository Function, zijn getroffen, met CVSS-scores die variëren van 4.3 tot 9.8, wat wijst op significante risico's voor de beschikbaarheid en vertrouwelijkheid van de systemen.

Oplossingen

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Referenties

CVE's

Producten

Oracle
Communications Cloud Native Core Binding Support Function
Communications Cloud Native Core Policy
Communications Cloud Native Core Console
Communications Cloud Native Core Security Edge Protection Proxy
Communications Unified Assurance
Management Cloud Engine
Communications Cloud Native Core Network Data Analytics Function
Communications Cloud Native Core Network Function Cloud Native Environment
Communications Element Manager
Communications Policy Management
Communications Session Report Manager
SD-WAN Edge
Communications Cloud Native Core Unified Data Repository
Communications Session Border Controller
Enterprise Communications Broker
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core DBTier
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Certificate Management
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications EAGLE Element Management System
Oracle Communications Operations Monitor
Oracle Communications User Data Repository
Oracle Communications Diameter Signaling Router
Oracle Communications Cloud Native Core Network Data Analytics Function
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Element Manager
Oracle Communications Policy Management
Oracle Communications Session Report Manager
Oracle SD-WAN Edge
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Session Border Controller
Oracle Enterprise Communications Broker
Oracle Communications Network Analytics Data Director
Oracle Communications Network Integrity
Oracle Communications Unified Assurance
Oracle Communications Billing and Revenue Management
Oracle Communications Messaging Server
Oracle Communications MetaSolv Solution
Oracle Communications Network Charging and Control
Oracle Communications Order and Service Management
Oracle Communications Pricing Design Center
Oracle Communications Service Catalog and Design
Oracle Communications Unified Inventory Management
Oracle Corporation
Oracle Communications Order and Service Management

Disclaimer

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.