PT-2018-8500 · Netiq · Netiq Identity Manager Oracle Ebs Driver

Published 2018-03-02 · Updated 2019-10-09 · CVE-2017-9278

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetIQ Identity Manager Oracle EBS driver versions prior to 4.0.2.0

Description The issue concerns the NetIQ Identity Manager Oracle EBS driver sending EBS logs that contain the driver authentication password. This could potentially disclose the password to attackers who have the ability to read the EBS tables.

Recommendations For versions prior to 4.0.2.0, update to version 4.0.2.0 or later to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-9278

Affected Products

Netiq Identity Manager Oracle Ebs Driver

References · 4

• https://osv.dev/vulnerability/CVE-2017-9278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9278 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1053200 · Note
• https://download.novell.com/Download?buildid=DKFkx_xPeaw~ · Note