CVE-2018-2913

published 2018-10-17

CVE-2018-2913: Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Monitoring Manager). Supported versions that are affected are 12.1.2.1.0…

Priority P2 66 critical 10 CVSS 3.0

AV N AC L PR N UI N S C C H I H A H

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Monitoring Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. While the vulnerability is in Oracle GoldenGate, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. Note: For Linux and Windows platforms, the CVSS score is 9.0 with Access Complexity as High. For all other platforms, the cvss score is 10.0. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
oracle	goldengate	—	—
oracle	goldengate	—	—
oracle	goldengate	—	—
oracle_corporation	goldengate	—	—
oracle_corporation	goldengate	—	—
oracle_corporation	goldengate	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 7809↗

command Nessus <long_buffer_overflow_string>↗

command START VERSION↗

command Nessus REPORT↗

• → Monitor TCP port 7809 for unauthenticated connections sending oversized payloads (stack buffer overflow trigger). The exploit sends a 2-byte big-endian length prefix followed by a long command string starting with 'Nessus\t' and hundreds of 'a' characters. ↗
• → Detect malformed GoldenGate Manager protocol messages on TCP/7809 where the connection initiation sends 'START VERSION' without the required separating tab character (triggers null pointer dereference / DoS). ↗
• → Detect incomplete REPORT commands sent to GoldenGate Manager on TCP/7809 (e.g., 'Nessus\tREPORT' with no trailing argument), which triggers a null pointer dereference via atoi(NULL). ↗
• → GoldenGate Manager protocol frames use a 2-byte big-endian length prefix followed by the command payload. Anomalously large length values or payloads exceeding normal command sizes on port 7809 should be alerted on. ↗
• → Stack smashing detection ('stack smashing detected') in GoldenGate Manager (mgr process) logs or crash dumps is a strong indicator of CVE-2018-2913 exploitation attempt. ↗
• → The vulnerable function is MGRSEC_check_client_access in mgrsec.c. Crash/core dumps referencing this function with overwritten return addresses (0x6161616161616161) confirm successful buffer overflow exploitation. ↗

• · Affected versions are Oracle GoldenGate 12.1.2.1.0, 12.2.0.2.0, and 12.3.0.1.0. The vulnerability is in the Monitoring Manager (Manager process) component. ↗
• · CVSS score differs by platform: 9.0 (High complexity) for Linux and Windows, 10.0 (Critical) for all other platforms. Prioritize patching on non-Linux/Windows platforms first. ↗
• · The vulnerability requires no authentication and is exploitable over the network via TCP, meaning any host with network access to port 7809 can attempt exploitation without credentials. ↗

CVSS provenance

nvd v3.0 10.0 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787