Vulnerabilities > CVE-2018-2939 - Unspecified vulnerability in Oracle Database Server

047910
CVSS 3.6 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
oracle
nessus

Summary

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18.1 and 18.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Core RDBMS accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Core RDBMS. CVSS 3.0 Base Score 8.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H).

Nessus

NASL familyDatabases
NASL idORACLE_RDBMS_CPU_JUL_2018.NASL
descriptionThe remote Oracle Database Server is missing the July 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities: - An unspecified vulnerability in the Oracle Spatial (jackson-databind) component of Oracle Database Server allows an unauthenticated, remote attacker with network access via multiple protocols to compromise Oracle Spatial. (CVE-2017-15095) - An unspecified vulnerability in the Core RDBMS component of Oracle Database Server allows a low privileged attacker to inject or manipulate RDBMS data, resulting in compromise of Core RDBMS. (CVE-2018-2939) - An unspecified vulnerability in the Java VM component of Oracle Database Server allows a low privileged attacker with Create Session, Create Procedure privilege to compromise a Java VM. (CVE-2018-3004, CVE-2018-3110) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen2020-06-02
modified2018-07-20
plugin id111219
published2018-07-20
reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/111219
titleOracle Database Server Multiple Vulnerabilities (July 2018 CPU)
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if (description)
{
  script_id(111219);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");

  script_cve_id(
    "CVE-2017-15095",
    "CVE-2018-2939",
    "CVE-2018-3004",
    "CVE-2018-3110"
  );
  script_bugtraq_id(103880);

  script_name(english:"Oracle Database Server Multiple Vulnerabilities (July 2018 CPU)");
  script_summary(english:"Checks installed patch info.");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Database Server is missing the July 2018 Critical
Patch Update (CPU). It is, therefore, affected by multiple
vulnerabilities:

  - An unspecified vulnerability in the Oracle Spatial
    (jackson-databind) component of Oracle Database Server
    allows an unauthenticated, remote attacker with network
    access via multiple protocols to compromise Oracle
    Spatial. (CVE-2017-15095)

  - An unspecified vulnerability in the Core RDBMS
    component of Oracle Database Server allows a low
    privileged attacker to inject or manipulate RDBMS data,
    resulting in compromise of Core RDBMS. (CVE-2018-2939)

  - An unspecified vulnerability in the Java VM component
    of Oracle Database Server allows a low privileged
    attacker with Create Session, Create Procedure privilege
    to compromise a Java VM. (CVE-2018-3004, CVE-2018-3110)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50f36723");
  # https://www.oracle.com/technetwork/security-advisory/alert-cve-2018-3110-5032149.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f4d652e");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the July 2018 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-15095");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"agent", value:"all");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include("oracle_rdbms_cpu_func.inc");

patches = make_nested_array();
# 18.3.0.0
patches["18.3.0.0"]["db"]["nix"] = make_array("patch_level", "18.3.0.0.180717", "CPU", "28317326, 28090523");
# 18.2.1.0
patches["18.2.1.0"]["db"]["nix"] = make_array("patch_level", "18.2.1.0.180717", "CPU", "28346593, 28601267, 28702032");
# RDBMS 12.2.0.1
patches["12.2.0.1"]["db"]["nix"] = make_array("patch_level", "12.2.0.1.180717", "CPU", "28317292, 28163133, 28662603, 28672345, 28714316");
patches["12.2.0.1"]["db"]["win"] = make_array("patch_level", "12.2.0.1.180717", "CPU", "27937914, 28247681");
# RDBMS 12.1.0.2
patches["12.1.0.2"]["db"]["nix"] = make_array("patch_level", "12.1.0.2.180717", "CPU", "28317232, 27547329, 28259833, 28349311");
patches["12.1.0.2"]["db"]["win"] = make_array("patch_level", "12.1.0.2.180717", "CPU", "27937907, 28289029, 28563501");
# RDBMS 11.2.0.4
patches["11.2.0.4"]["db"]["nix"] = make_array("patch_level", "11.2.0.4.180717", "CPU", "28317175, 27734982, 28204707");
patches["11.2.0.4"]["db"]["win"] = make_array("patch_level", "11.2.0.4.180717", "CPU", "27695940, 28265827");

# OJVM 18.3.0.0
patches["18.3.0.0"]["ojvm"]["nix"] = make_array("patch_level", "18.3.0.0.180717", "CPU", "27923415, 28502229");
# OJVM 12.2.0.1
patches["12.2.0.1"]["ojvm"]["nix"] = make_array("patch_level", "12.2.0.1.180717", "CPU", "27923353, 28440725");
patches["12.2.0.1"]["ojvm"]["win"] = make_array("patch_level", "12.2.0.1.180717", "CPU", "28135129, 28416087");
# OJVM 12.1.0.2
patches["12.1.0.2"]["ojvm"]["nix"] = make_array("patch_level", "12.1.0.2.180717", "CPU", "27923320, 28440711");
patches["12.1.0.2"]["ojvm"]["win"] = make_array("patch_level", "12.1.0.2.180717", "CPU", "28135126, 28135128");
# OJVM 11.2.0.4
patches["11.2.0.4"]["ojvm"]["nix"] = make_array("patch_level", "11.2.0.4.180717", "CPU", "27923163, 28440700");
patches["11.2.0.4"]["ojvm"]["win"] = make_array("patch_level", "11.2.0.4.180717", "CPU", "28135121, 28416098");

check_oracle_database(patches:patches, high_risk:TRUE);