PT-2019-1193 · Oracle · Oracle Database Server+1

Publicado 2019-01-16 · Atualizado 2020-08-24 · CVE-2019-2444

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1 and 18c

Description The issue is related to insufficient access control in the Core RDBMS component of Oracle Database Server. Exploitation of this issue can allow an attacker to gain full control over the application. The vulnerability can be exploited by a low-privileged attacker with local logon privilege, and successful attacks require human interaction from a person other than the attacker. The impact of successful attacks can be significant, potentially resulting in the takeover of Core RDBMS.

Recommendations For versions 12.2.0.1 and 18c, consider restricting access to the Core RDBMS component to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling any functionality that relies on local logon privilege to the infrastructure where Core RDBMS executes. Restrict network access via multiple protocols to reduce the attack surface.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2019-00274

CVE-2019-2444

Produtos afetados

Oracle Database

Oracle Database Server

Referências · 6

• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Nota
• https://bdu.fstec.ru/vul/2019-00274 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2444 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-2444 · Nota de Segurança
• http://securityfocus.com/bid/106584 · Nota
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Aviso do Fabricante