CVE-2018-11058 Memory corruption in BSAFE Crypto-C Micro Edition
Remote attackers can trigger a buffer over-read in RSA BSAFE libraries via malicious ASN.1 data, potentially causing crashes or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11058?
CVE-2018-11058 is a high-severity memory corruption vulnerability in Oracle Application Testing Suite, published on 14 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.
Weakness: CWE-125
Which versions are affected by CVE-2018-11058?
It affects 13 products.
Products include Dell Bsafe, Dell Bsafe Crypto-C, Oracle Application Testing Suite, Oracle Communications Analytics, Oracle Communications Ip Service Activator, Oracle Core Rdbms and 7 more.
How do I fix CVE-2018-11058?
No fix has been published for CVE-2018-11058 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-11058 being exploited?
There is no known exploitation of CVE-2018-11058 in the wild and no public exploit code.
Other vulnerabilities in Oracle Application Testing Suite
Sources
Also known as GHSA-6pm8-q9vc-vxxj.