CVE-2018-11056 Denial of service in BSAFE Crypto-C Micro Edition
Remote attackers can cause denial of service via stack exhaustion by sending malicious ASN.1 data to applications using RSA BSAFE libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-11056?
CVE-2018-11056 is a medium-severity denial of service vulnerability in Oracle Application Testing Suite, published on 31 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service.
Weakness: CWE-400
Which versions are affected by CVE-2018-11056?
It affects 13 products.
Products include Dell Bsafe, Dell Bsafe Crypto-C, Oracle Application Testing Suite, Oracle Communications Analytics, Oracle Communications Ip Service Activator, Oracle Core Rdbms and 7 more.
How do I fix CVE-2018-11056?
No fix has been published for CVE-2018-11056 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-11056 being exploited?
There is no known exploitation of CVE-2018-11056 in the wild and no public exploit code.
Other vulnerabilities in Oracle Application Testing Suite
Sources
Also known as GHSA-7h4p-6qh6-g2m2.