PT-2020-1541 · Oracle · Oracle Database Server+1

Alexander Kornbrust · Published 2020-01-14 · Updated 2022-10-25 · CVE-2020-2511

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c

Description The issue is related to insufficient access control in the Core RDBMS component of Oracle Database Server. It can be exploited by a remote attacker with low privileges, having Create Session privilege and network access via OracleNet, to compromise Core RDBMS. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Core RDBMS.

Recommendations For versions 12.1.0.2, 12.2.0.1, 18c, and 19c, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the OracleNet protocol to minimize the risk of exploitation. Restrict Create Session privilege to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00534

CVE-2020-2511

Affected Products

Oracle Database

Oracle Database Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-2511 · Security Note
• https://bdu.fstec.ru/vul/2020-00534 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2511 · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note