PT-2020-2291 · Oracle · Oracle Database Server+1

Published

2020-04-14

·

Updated

2020-04-16

·

CVE-2020-2734

CVSS v2.0

3.5

Low

VectorAV:N/AC:M/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c
Description The issue is related to the RDBMS/Optimizer component of Oracle Database Server, where an easily exploitable vulnerability allows a high-privileged attacker with Execute on DBMS SQLTUNE privilege and network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized read access to a subset of RDBMS/Optimizer accessible data. The vulnerability is associated with inadequate access control.
Recommendations For versions 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting access to the DBMS SQLTUNE privilege to minimize the risk of exploitation. As a temporary workaround, limit network access via Oracle Net to reduce the attack surface. Avoid relying on human interaction that may facilitate successful attacks, and implement additional security measures to protect against unauthorized read access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2020-02245
CVE-2020-2734

Affected Products

Oracle Database
Oracle Database Server