NCSC-2025-0021

Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.

De kwetsbaarheden stellen ongeauthenticeerde kwaadwillenden in staat om Denial of Service (DoS) aanvallen uit te voeren of om ongeautoriseerde toegang tot gevoelige gegevens te verkrijgen. Specifieke versies, zoals 24.2.0 en 24.3.0 van de Cloud Native Core Network Function, zijn bijzonder kwetsbaar. Kwaadwillenden kunnen deze kwetsbaarheden misbruiken door speciaal geprepareerde HTTP-verzoeken te sturen naar het kwetsbare systeem.

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Dependency on Vulnerable Third-Party Component

Always-Incorrect Control Flow Implementation

Asymmetric Resource Consumption (Amplification)

Path Traversal: '.../...//'

Return of Pointer Value Outside of Expected Range

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Use of Potentially Dangerous Function

Unchecked Input for Loop Condition

Multiple Interpretations of UI Input

Incorrect Calculation of Buffer Size

Use of Weak Hash

Improper Handling of Length Parameter Inconsistency

Incorrect Resource Transfer Between Spheres

Insufficient Granularity of Access Control

Insertion of Sensitive Information Into Sent Data

Acceptance of Extraneous Untrusted Data With Trusted Data

Improper Handling of Exceptional Conditions

Improper Verification of Cryptographic Signature

Excessive Iteration

Improper Handling of Case Sensitivity

Time-of-check Time-of-use (TOCTOU) Race Condition

Expected Behavior Violation

Double Free

Missing Encryption of Sensitive Data

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Improper Check for Unusual or Exceptional Conditions

Improper Check or Handling of Exceptional Conditions

Reachable Assertion

Uncontrolled Search Path Element

Use of Password Hash Instead of Password for Authentication

Integer Overflow to Buffer Overflow

Access of Resource Using Incompatible Type ('Type Confusion')

Relative Path Traversal

Improper Encoding or Escaping of Output

Insufficient Verification of Data Authenticity

Observable Discrepancy

Improper Validation of Integrity Check Value

Missing Cryptographic Step

Integer Overflow or Wraparound

User Interface (UI) Misrepresentation of Critical Information

UNIX Symbolic Link (Symlink) Following

Files or Directories Accessible to External Parties

Authorization Bypass Through User-Controlled Key

Use of Hard-coded Credentials

Unrestricted Upload of File with Dangerous Type

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Improper Resource Shutdown or Release

Improper Access Control

Improper Restriction of Operations within the Bounds of a Memory Buffer

Inefficient Regular Expression Complexity

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Use After Free

NULL Pointer Dereference

Use of a Broken or Risky Cryptographic Algorithm

Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling

Deserialization of Untrusted Data

Uncaught Exception

Uncontrolled Recursion

Incorrect Authorization

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Restriction of XML External Entity Reference

Out-of-bounds Write

Exposure of Sensitive Information to an Unauthorized Actor

Heap-based Buffer Overflow

Stack-based Buffer Overflow

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Loop with Unreachable Exit Condition ('Infinite Loop')

Improper Privilege Management

Improper Input Validation

Generation of Error Message Containing Sensitive Information

Incorrect Default Permissions

Authentication Bypass by Capture-replay

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')