PT-2023-2642 · Oracle · Oracle Database Server

Emad Al-Mousa · Publicado 2023-04-18 · Atualizado 2023-04-19 · CVE-2023-21918

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19c through 21c

Description The issue exists due to insufficient input validation in the Oracle Database Recovery Manager component of Oracle Database Server. This can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash of Oracle Database Recovery Manager, which may significantly impact additional products.

Recommendations For versions 19c and 21c, apply the necessary patches or updates to fix the vulnerability in the Oracle Database Recovery Manager component. As a temporary workaround, consider restricting network access via Oracle Net to minimize the risk of exploitation. Restrict Local SYSDBA privilege to prevent high privileged attackers from compromising Oracle Database Recovery Manager.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-02482

CVE-2023-21918

Produtos afetados

Oracle Database Server

Referências · 7

• https://login.oracle.com · Nota
• https://osv.dev/vulnerability/CVE-2023-21918 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-21918 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-02482 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023041844 · Nota
• https://oracle.com/security-alerts/cpuapr2023.html · Aviso do Fabricante
• https://t.me/cvenotify/48640 · Publicação no Telegram