PT-2019-3700 · Oracle · Oracle Database Server+1

Published 2019-01-01 · Updated 2019-10-21 · CVE-2019-2954

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c

Description The issue is related to the Core RDBMS component of Oracle Database Server, where an easily exploitable vulnerability allows a low-privileged attacker with Create Session and Create Procedure privileges to compromise the Core RDBMS. This requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to Core RDBMS data, including update, insert, or delete capabilities, as well as the ability to cause a partial denial of service.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting access to the Core RDBMS component to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of users with Create Session and Create Procedure privileges to reduce the potential impact of the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-03924

CVE-2019-2954

Affected Products

Oracle Database

Oracle Database Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-2954 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-2954 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03924 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Note