PT-2019-2778 · Oracle · Oracle Odbc Driver+2

Publicado 2019-01-01 · Atualizado 2020-08-24 · CVE-2019-2799

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4 through 18c

Description The issue is related to the Oracle ODBC Driver component, which has a vulnerability that can be exploited by a low-privileged attacker with network access via multiple protocols. This can result in the takeover of the Oracle ODBC Driver. The vulnerability affects Windows platforms only.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c, consider disabling the Oracle ODBC Driver component until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the Oracle ODBC Driver to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-02725

CVE-2019-2799

ZDI-19-662

Produtos afetados

Oracle Database

Oracle Database Server

Oracle Odbc Driver

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-2799 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2799 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-662 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02725 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Aviso do Fabricante
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Nota