PT-2019-1193 · Oracle · Oracle Database Server+1

Published 2019-01-16 · Updated 2020-08-24 · CVE-2019-2444

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1 and 18c

Description The issue is related to insufficient access control in the Core RDBMS component of Oracle Database Server. Exploitation of this issue can allow an attacker to gain full control over the application. The vulnerability can be exploited by a low-privileged attacker with local logon privilege, and successful attacks require human interaction from a person other than the attacker. The impact of successful attacks can be significant, potentially resulting in the takeover of Core RDBMS.

Recommendations For versions 12.2.0.1 and 18c, consider restricting access to the Core RDBMS component to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling any functionality that relies on local logon privilege to the infrastructure where Core RDBMS executes. Restrict network access via multiple protocols to reduce the attack surface.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-00274

CVE-2019-2444

Affected Products

Oracle Database

Oracle Database Server

References · 6

• https://bdu.fstec.ru/vul/2019-00274 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2444 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note
• http://securityfocus.com/bid/106584 · Note