PT-2018-19163 · Oracle · Oracle Database Server+1

Publicado 2018-04-23 · Atualizado 2020-08-24 · CVE-2019-2547

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c

Description The issue is related to the Java VM component of Oracle Database Server. It allows a low-privileged attacker with Create Session and Create Procedure privileges and network access via multiple protocols to compromise the Java VM. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized ability to cause a partial denial of service of the Java VM. The vulnerability can also potentially lead to the takeover of the Java VM.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c, consider restricting access to the Java VM component until a patch is available. As a temporary workaround, consider disabling the Java VM component to minimize the risk of exploitation. Restrict network access via multiple protocols to reduce the attack surface.

Correção

Identificadores relacionados

CVE-2019-2547

Produtos afetados

Oracle Database

Oracle Database Server

Referências · 4

• http://securityfocus.com/bid/106594 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-2547 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-2547 · Aviso do Fabricante