PT-2020-3251 · Oracle · Oracle Database Server+1

Published 2020-07-14 · Updated 2020-07-21 · CVE-2020-2968

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4 through 19c

Description The issue exists due to insufficient input validation in the Java VM component of Oracle Database Server. This allows a remote attacker to potentially gain full control over the application. The vulnerability is difficult to exploit and requires a low-privileged attacker with Create Session and Create Procedure privileges, as well as network access via multiple protocols. Successful attacks need human interaction from a person other than the attacker and may significantly impact additional products, potentially resulting in the takeover of the Java VM.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting network access via multiple protocols to minimize the risk of exploitation. As a temporary workaround, limit the privileges of users with Create Session and Create Procedure privileges to reduce the potential impact of the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03559

CVE-2020-2968

Affected Products

Oracle Database

Oracle Database Server

References · 7

• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2968 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2968 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03559 · Security Note
• https://t.me/cvenotify/5059 · Telegram Post
• https://support.oracle.com/rs?type=doc&id=2664876.1 · Note
• https://cybersecurity-help.cz/vdb/SB2020071520 · Note