PT-2023-9563 · Oracle · Oracle Database Server

Tobias Clarke · Published 2023-12-07 · Updated 2024-10-21 · CVE-2024-21242

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.24 Oracle Database Server versions 21.3 through 21.15 Oracle Database Server versions 23.4 through 23.5

Description The issue is related to errors in resource release in the XML Database component of Oracle Database Server. It can be exploited by a remote attacker to cause a denial of service by sending HTTP packets. The vulnerability can be exploited with low privileges and requires human interaction from someone other than the attacker. Successful attacks can result in unauthorized ability to cause a partial denial of service of the XML Database.

Recommendations For Oracle Database Server versions 19.3 through 19.24, update to a version outside of this range to resolve the issue. For Oracle Database Server versions 21.3 through 21.15, update to a version outside of this range to resolve the issue. For Oracle Database Server versions 23.4 through 23.5, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the XML Database component to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2024-08442

CVE-2024-21242

Affected Products

Oracle Database Server

References · 8

• https://bdu.fstec.ru/vul/2024-08442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21242 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21242 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1846284344366714939 · Twitter Post
• https://t.me/cvenotify/98986 · Telegram Post
• https://vuldb.com/?id.280485 · Note
• https://vulners.com/nvd/NVD:CVE-2024-21242 · Note