CVE-2017-3581: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR M...

Security readout for executives and security teams

CVE-2017-3581 affects Oracle Automatic Service Request Manager before version 5.7. An attacker who already has low-privileged logon access to the infrastructure running ASR could take over the ASR component, with confidentiality, integrity, and availability impact. Exposure is limited to organizations running Oracle Automatic Service Request Manager prior to 5.7. The attacker needs logon access to the infrastructure where ASR executes; the source bundle does not indicate direct internet exploitation. Treat as high priority where ASR Manager is deployed, especially on shared administration infrastructure. The business risk is takeover of a support automation component, but urgency depends on whether local logon access is broadly available. Mitigation focus: Upgrade Oracle ASR Manager from versions prior to 5.7.; Apply Oracle April 2017 CPU guidance for this ASR issue.; Restrict low-privileged logon access to ASR infrastructure hosts..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.