PT-2018-2249 · Oracle · Oracle Goldengate

Published 2018-10-16 · Updated 2018-10-24 · CVE-2018-2914

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 12.1.2.1.0, 12.2.0.2.0, 12.3.0.1.0

Description The issue is related to a null pointer dereference in the Manager component of Oracle GoldenGate. It allows an unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. The vulnerability can be exploited by sending an incorrect command, such as a START VERSION command with a missing separator, during a TCP connection.

Recommendations For versions 12.1.2.1.0, 12.2.0.2.0, and 12.3.0.1.0, consider restricting access to the Manager component until a patch is available. As a temporary workaround, avoid using the START VERSION command with missing separators in the TCP connection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2019-00342

CVE-2018-2914

Affected Products

Oracle Goldengate

References · 6

• 🔥 https://tenable.com/security/research/tra-2018-31 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-2914 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2914 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00342 · Security Note
• http://securityfocus.com/bid/105651 · Note