PT-2019-3709 · Oracle · Oracle Database Server+1

Published 2019-01-01 · Updated 2020-08-24 · CVE-2019-2939

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1, 18c, 19c

Description The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, which is easily exploitable and allows a low-privileged attacker with Create Session privilege and network access via OracleNet to compromise Core RDBMS. This can result in unauthorized read access to a subset of Core RDBMS accessible data. The vulnerability may also impact additional products.

Recommendations For versions 12.2.0.1, 18c, and 19c, consider restricting network access via OracleNet to minimize the risk of exploitation. As a temporary workaround, limit the Create Session privilege to reduce the attack surface. Avoid using the Core RDBMS component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-03936

CVE-2019-2939

Affected Products

Oracle Database

Oracle Database Server

References · 6

• https://osv.dev/vulnerability/CVE-2019-2939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2939 · Security Note
• https://bdu.fstec.ru/vul/2019-03936 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Note
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note