PT-2021-15705 · Oracle · Oracle Communications Session Border Controller

Sven Woynoski · Published 2021-10-20 · Updated 2021-10-26 · CVE-2021-2416

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Oracle Communications Session Border Controller versions 8.4 and 9.0

Description: The issue allows a high privileged attacker with network access via HTTP to compromise the Oracle Communications Session Border Controller. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of the Oracle Communications Session Border Controller.

Recommendations: For version 8.4, update to a version that includes the fix for this issue. For version 9.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting HTTP access to the Oracle Communications Session Border Controller to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-2416

Affected Products

Oracle Communications Session Border Controller

References · 3

• https://oracle.com/security-alerts/cpuoct2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2416 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2416 · Vendor Advisory