Advisory Details

January 22nd, 2016

Oracle GoldenGate Denial of Service Vulnerability

ZDI-16-021
ZDI-CAN-3039

CVE ID CVE-2016-0450
CVSS SCORE 5, (AV:N/AC:L/Au:N/C:N/I:N/A:P)
AFFECTED VENDORS Oracle
AFFECTED PRODUCTS GoldenGate
VULNERABILITY DETAILS


This vulnerability allows remote attackers to cause a denial condition on vulnerable installations of Oracle GoldenGate. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the GoldenGate mgr process, which listens on TCP port 7809. By default, this process does not require authentication before accepting data delivery and GGSCI commands from a remote machine. This allows for a remote attacker to disable the service or exhaust resources on the target machine.

VENDOR RESPONSE Oracle has issued an update to correct this vulnerability. More details can be found at:
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
DISCLOSURE TIMELINE
  • 2015-07-10 - Vulnerability reported to vendor
  • 2016-01-22 - Coordinated public release of advisory
CREDIT Mike Arnold (Bruk0ut)
BACK TO ADVISORIES