PT-2019-1928 · Oracle · Oracle Database Server

Publicado 2019-04-16 · Atualizado 2020-08-24 · CVE-2019-2619

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c

Description The issue is related to a vulnerability in the Portable Clusterware component of Oracle Database Server, which can be exploited by a high-privileged attacker with Grid Infrastructure User privilege and logon to the infrastructure where Portable Clusterware executes. This vulnerability can compromise Portable Clusterware and may significantly impact additional products, potentially resulting in the takeover of Portable Clusterware.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-01597

CVE-2019-2619

Produtos afetados

Oracle Database Server

Referências · 5

• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Nota
• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-2619 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-2619 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01597 · Nota de Segurança