Este CPU comprende aproximadamente un 35% de vulnerabilidades (Common Vulnerabilities and Exposures- CVEs) que no son propias de productos Oracle, es decir, de los 334 parches de seguridad proporcionados por este CPU, 117 son para CVEs de productos "non-Oracle", lo cual implica correcciones de seguridad para productos de terceros (por ejemplo, componentes de código abierto) que si son incluidos en las distribuciones tradicionales de productos de Oracle. En varios casos, el mismo CVE aparece varias veces en el “Critical Patch Update Advisory”, porque un componente con determinada vulnerabilidad (por ejemplo, Apache) puede estar presente en muchos productos Oracle diferentes.
El estándar CVSS v3 considera que las vulnerabilidades con un puntaje base de CVSS entre 9.0 y 10.0 tienen una calificación cualitativa de "Crítica". Las vulnerabilidades con un puntaje base de CVSS entre 7.0 y 8.9 tienen una calificación cualitativa de "Alta". Al igual que con el CPU anterior, la cantidad de CVEs que no son propias de Oracle, representan una cantidad significativa de expuestos críticos y de alta gravedad: 27 de las 117 CVE que no son propias de productos Oracle, son por vulnerabilidades altas y críticas. Lo cual resulta significativo.
En cuanto a bases de datos, este CPU de enero 2020 incluye 12 nuevos parches de seguridad para Database Server. El puntaje base más alto de CVSS para estas vulnerabilidades es 7.7, con lo cual ninguna de ellas alcanza el grado de "crítica". Tres de estas 12 vulnerabilidades pueden explotarse de forma remota sin autenticación, es decir, pueden explotarse en una red sin requerir credenciales de usuario (es algo para tener en cuenta). Por otro lado, ninguno de estos parches es aplicable a instalaciones "only-client", es decir, instalaciones que no tienen instalado Oracle Database Server.
CVE#
|
Description
|
CVE-2019-10072
|
Vulnerability in the Workload Manager (Apache Tomcat) component of
Oracle Database Server. Supported versions that are affected are 12.2.0.1,
18c and 19c. Easily exploitable vulnerability allows unauthenticated attacker
with network access via HTTP to compromise Workload Manager (Apache Tomcat).
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of Workload
Manager (Apache Tomcat).
Note: This patch addresses also additional three vulnerabilities: CVE-2018-11784, CVE-2019-0199, CVE-2019-0221 and CVE-2019-0232. For Windows platform - due to CVE-2019-0232 - the CVSS 3.0 score is 8.1. CVSS v3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). |
CVE-2020-2510
|
Vulnerability in the Core RDBMS component of Oracle Database Server.
Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
and 19c. Difficult to exploit vulnerability allows unauthenticated attacker
with network access via OracleNet to compromise Core RDBMS. Successful
attacks require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in takeover of Core
RDBMS.
CVSS v3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). |
CVE-2020-2511
|
Vulnerability in the Core RDBMS component of Oracle Database Server.
Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.
Easily exploitable vulnerability allows low privileged attacker having Create
Session privilege with network access via OracleNet to compromise Core RDBMS.
While the vulnerability is in Core RDBMS, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of Core RDBMS.
CVSS v3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). |
CVE-2020-2512
|
Vulnerability in the Database Gateway for ODBC component of Oracle
Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2,
12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows
unauthenticated attacker with network access via OracleNet to compromise
Database Gateway for ODBC. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of Database Gateway for ODBC.
CVSS v3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). |
CVE-2020-2515
|
Vulnerability in the Database Gateway for ODBC component of Oracle
Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2,
12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low
privileged attacker having Create Session privilege with network access via
OracleNet to compromise Database Gateway for ODBC. Successful attacks of this
vulnerability can result in unauthorized update, insert or delete access to
some of Database Gateway for ODBC accessible data as well as unauthorized
read access to a subset of Database Gateway for ODBC accessible data and
unauthorized ability to cause a partial denial of service (partial DOS) of
Database Gateway for ODBC.
CVSS v3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). |
CVE-2020-2516
|
Vulnerability in the Core RDBMS component of Oracle Database Server.
Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.
Easily exploitable vulnerability allows high privileged attacker having
Create Materialized View, Create Table privilege with network access via
OracleNet to compromise Core RDBMS. Successful attacks require human
interaction from a person other than the attacker. Successful attacks of this
vulnerability can result in unauthorized update, insert or delete access to
some of Core RDBMS accessible data.
CVSS v3.0 Base Score 2.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N). |
CVE-2020-2517
|
Vulnerability in the Database Gateway for ODBC component of Oracle
Database Server. Supported versions that are affected are 12.2.0.1, 18c and
19c. Difficult to exploit vulnerability allows high privileged attacker
having Create Procedure, Create Database Link privilege with network access
via OracleNet to compromise Database Gateway for ODBC. Successful attacks of
this vulnerability can result in unauthorized update, insert or delete access
to some of Database Gateway for ODBC accessible data and unauthorized ability
to cause a partial denial of service (partial DOS) of Database Gateway for
ODBC.
CVSS v3.0 Base Score 3.3 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L). |
CVE-2020-2518
|
Vulnerability in the Java VM component of Oracle Database Server.
Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
and 19c. Difficult to exploit vulnerability allows low privileged attacker
having Create Session privilege with network access via multiple protocols to
compromise Java VM. Successful attacks of this vulnerability can result in
takeover of Java VM.
CVSS v3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). |
CVE-2020-2527
|
Vulnerability in the Core RDBMS component of Oracle Database Server.
Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.
Easily exploitable vulnerability allows high privileged attacker having
Create Index, Create Table privilege with network access via OracleNet to
compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized read access to a subset of Core RDBMS
accessible data.
CVSS v3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N). |
CVE-2020-2568
|
Vulnerability in the Oracle Applications DBA component of Oracle
Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1,
18c and 19c. Easily exploitable vulnerability allows low privileged attacker
having Local Logon privilege with logon to the infrastructure where Oracle
Applications DBA executes to compromise Oracle Applications DBA. Successful
attacks require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized update,
insert or delete access to some of Oracle Applications DBA accessible data
and unauthorized ability to cause a partial denial of service (partial DOS)
of Oracle Applications DBA.
CVSS v3.0 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L). |
CVE-2020-2569
|
Vulnerability in the Oracle Applications DBA component of Oracle
Database Server. Supported versions that are affected are 12.2.0.1, 18c and
19c. Easily exploitable vulnerability allows low privileged attacker having
Local Logon privilege with logon to the infrastructure where Oracle
Applications DBA executes to compromise Oracle Applications DBA. Successful
attacks require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized update,
insert or delete access to some of Oracle Applications DBA accessible data
and unauthorized ability to cause a partial denial of service (partial DOS)
of Oracle Applications DBA.
CVSS v3.0 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L). |
CVE-2020-2731
|
Vulnerability in the Core RDBMS component of Oracle Database Server.
Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.
Easily exploitable vulnerability allows low privileged attacker having Local
Logon privilege with logon to the infrastructure where Core RDBMS executes to
compromise Core RDBMS. Successful attacks require human interaction from a
person other than the attacker. Successful attacks of this vulnerability can
result in unauthorized update, insert or delete access to some of Core RDBMS
accessible data and unauthorized ability to cause a partial denial of service
(partial DOS) of Core RDBMS.
CVSS v3.0 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L). |
Oracle, como siempre
lo hace, sugiere a sus clientes que permanezcan en versiones con soporte
activo y recomienda fuertemente que se apliquen los parches de seguridad necesarios
sin demora.
Para más información:
No hay comentarios:
Publicar un comentario