Critical Patch For Oracle's Identity Manager

SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Critical Patch For Oracle's Identity Manager
On Friday, Oracle released a critical patch for it's Identity Manager, which is part of Fusion Middleware. The vulnerability patched with this update does affect all current versions of the product, and has a CVSS score of 10. The patch comes just about two weeks after Oracle's regular Critical Patch Update (CPU). According to Oracle's summary, the patch secures a default account that can be used to log in via HTTP to take over the system. Once these default credentials become known, exploitation should be trivial. For details, see Oracle's announcement here: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10151-4016513.html --- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute STI\|Twitter\| I will be teaching next: Intrusion Detection In-Depth - SANS London May 2021	Johannes 4113 Posts ISC Handler Oct 30th 2017
Thread locked Subscribe	Oct 30th 2017 3 years ago