PT-2019-1246 · Oracle · Oracle Communications Diameter Signaling Router

Published 2019-01-15 · Updated 2020-08-24 · CVE-2019-2399

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Communications Diameter Signaling Router (DSR) versions prior to 8.3

Description The issue is related to inadequate access control in the Security component of the Oracle Communications Diameter Signaling Router (DSR), allowing an unauthenticated attacker with network access via HTTP to compromise the system. This can result in unauthorized read access to a subset of Oracle Communications Diameter Signaling Router (DSR) accessible data and the ability to cause a partial denial of service (partial DOS) of Oracle Communications Diameter Signaling Router (DSR).

Recommendations For versions prior to 8.3, update to version 8.3 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-00396

CVE-2019-2399

Affected Products

Oracle Communications Diameter Signaling Router

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-2399 · Security Note
• https://bdu.fstec.ru/vul/2019-00396 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2399 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Vendor Advisory
• http://securityfocus.com/bid/106580 · Note
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note