PT-2018-2249 · Oracle · Oracle Goldengate

Publicado 2018-10-16 · Atualizado 2018-10-24 · CVE-2018-2914

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 12.1.2.1.0, 12.2.0.2.0, 12.3.0.1.0

Description The issue is related to a null pointer dereference in the Manager component of Oracle GoldenGate. It allows an unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. The vulnerability can be exploited by sending an incorrect command, such as a START VERSION command with a missing separator, during a TCP connection.

Recommendations For versions 12.1.2.1.0, 12.2.0.2.0, and 12.3.0.1.0, consider restricting access to the Manager component until a patch is available. As a temporary workaround, avoid using the START VERSION command with missing separators in the TCP connection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2019-00342

CVE-2018-2914

Produtos afetados

Oracle Goldengate

Referências · 6

• 🔥 https://tenable.com/security/research/tra-2018-31 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-2914 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-2914 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Aviso do Fabricante
• http://securityfocus.com/bid/105651 · Nota
• https://bdu.fstec.ru/vul/2019-00342 · Nota de Segurança