PT-2019-3709 · Oracle · Oracle Database Server+1

Publicado 2019-01-01 · Atualizado 2020-08-24 · CVE-2019-2939

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1, 18c, 19c

Description The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, which is easily exploitable and allows a low-privileged attacker with Create Session privilege and network access via OracleNet to compromise Core RDBMS. This can result in unauthorized read access to a subset of Core RDBMS accessible data. The vulnerability may also impact additional products.

Recommendations For versions 12.2.0.1, 18c, and 19c, consider restricting network access via OracleNet to minimize the risk of exploitation. As a temporary workaround, limit the Create Session privilege to reduce the attack surface. Avoid using the Core RDBMS component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2019-03936

CVE-2019-2939

Produtos afetados

Oracle Database

Oracle Database Server

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-2939 · Aviso do Fabricante
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-2939 · Nota de Segurança
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Nota
• https://bdu.fstec.ru/vul/2019-03936 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Aviso do Fabricante