Vulnerabilities > CVE-2019-2516 - Unspecified vulnerability in Oracle Database Server

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(124155);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");

  script_cve_id(
    "CVE-2019-2516",
    "CVE-2019-2517",
    "CVE-2019-2518",
    "CVE-2019-2571",
    "CVE-2019-2582",
    "CVE-2019-2619"
  );
  script_bugtraq_id(
    107919,
    107936,
    107940,
    107945
  );

  script_name(english:"Oracle Database Server Multiple Vulnerabilities (Apr 2019 CPU)");
  script_summary(english:"Checks installed patch info.");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Database Server is missing the April 2019
Critical Patch Update (CPU). It is, therefore, affected by multiple
vulnerabilities :

  - An authenticated local Portable Clusterware takeover
    vulnerability exists in the Oracle RDBMS. An authenticated, local
    attacker with the Grid Infrastructure User privilege with logon
    to the infrastructure where Portable Clusterware executes can
    exploit this to take over the Portable Clusterware component of
    Oracle RDBMS, resulting in the disclosure or manipulation of
    arbitrary data. (CVE-2019-2516) (CVE-2019-2619)

  - An authenticated remote database takeover vulnerability exists in
    the Oracle RDBMS. An authenticated, remote attacker with the
    DBFS_ROLE privilege can exploit this via the Oracle Net protocol
    to take over the back-end database, resulting in the disclosure
    or manipulation of arbitrary data. (CVE-2019-2517)

  - An authenticated remote Java VM takeover vulnerability exists in
    the Oracle RDBMS. An authenticated, remote attacker with the
    Create Session, Create Procedure privileges can exploit this to
    take over the Java VM. (CVE-2019-2518)

  - An authenticated remote RDBMS DataPump takeover vulnerability
    exists in the Oracle RDBMS. An authenticated, remote attacker
    with the DBA role privilege can exploit this via the Oracle Net
    protocol to take over the RDBMS DataPump component of Oracle
    RDBMS. (CVE-2019-2571)

  - An unauthenticated remote information disclosure vulnerability
    exists in the Oracle RDBMS. An unauthenticated, remote attacker
    can exploit this via the Oracle Net protocol to obtain read
    access to a unspecified subset of Core RDBMS accessible data.
    (CVE-2019-2582)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixDB
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ee33210c");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the April 2019 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2517");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date",value:"2019/04/16");
  script_set_attribute(attribute:"patch_publication_date",value:"2019/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/18");

  script_set_attribute(attribute:"plugin_type",value:"combined");
  script_set_attribute(attribute:"cpe",value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"agent", value:"all");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include("oracle_rdbms_cpu_func.inc");

patches = make_nested_array();

# RDBMS 18.6.0.0
patches["18.6.0.0"]["db"]["nix"] = make_array("patch_level", "18.6.0.0.190416", "CPU", "29301631");
patches["18.6.0.0"]["db"]["win"] = make_array("patch_level", "18.6.0.0.190416", "CPU", "29589622");
# RDBMS 18.5.1.0
patches["18.5.1.0"]["db"]["nix"] = make_array("patch_level", "18.5.1.0.190416", "CPU", "29230887");
# RDBMS 18.4.2.0
patches["18.4.2.0"]["db"]["nix"] = make_array("patch_level", "18.4.2.0.190416", "CPU", "29230809");
# RDBMS 12.2.0.1
patches["12.2.0.1"]["db"]["nix"] = make_array("patch_level", "12.2.0.1.190416", "CPU", "29314339, 29230821, 29230950");
patches["12.2.0.1"]["db"]["win"] = make_array("patch_level", "12.2.0.1.190416", "CPU", "29394003");
# RDBMS 12.1.0.2
patches["12.1.0.2"]["db"]["nix"] = make_array("patch_level", "12.1.0.2.190416", "CPU", "29141015, 29141038");
patches["12.1.0.2"]["db"]["win"] = make_array("patch_level", "12.1.0.2.190416", "CPU", "29413116");
# RDBMS 11.2.0.4
patches["11.2.0.4"]["db"]["nix"] = make_array("patch_level", "11.2.0.4.190416", "CPU", "29141056, 29257245");
patches["11.2.0.4"]["db"]["win"] = make_array("patch_level", "11.2.0.4.190416", "CPU", "29218820");

# OJVM 19.3.0.0
patches["19.3.0.0"]["ojvm"]["nix"] = make_array("patch_level", "19.3.0.0.190416", "CPU", "29548437");
# OJVM 18.6.0.0
patches["18.6.0.0"]["ojvm"]["nix"] = make_array("patch_level", "18.6.0.0.190416", "CPU", "29249584");
patches["18.6.0.0"]["ojvm"]["win"] = make_array("patch_level", "18.6.0.0.190416", "CPU", "29249584");
# OJVM 12.2.0.1
patches["12.2.0.1"]["ojvm"]["nix"] = make_array("patch_level", "12.2.0.1.190416", "CPU", "29249637");
patches["12.2.0.1"]["ojvm"]["win"] = make_array("patch_level", "12.2.0.1.190416", "CPU", "29281550");
# OJVM 12.1.0.2
patches["12.1.0.2"]["ojvm"]["nix"] = make_array("patch_level", "12.1.0.2.190416", "CPU", "29251241");
patches["12.1.0.2"]["ojvm"]["win"] = make_array("patch_level", "12.1.0.2.190416", "CPU", "29447962");
# OVJM 11.2.0.4
patches["11.2.0.4"]["ojvm"]["nix"] = make_array("patch_level", "11.2.0.4.190416", "CPU", "29251270");
patches["11.2.0.4"]["ojvm"]["win"] = make_array("patch_level", "11.2.0.4.190416", "CPU", "29447971");

check_oracle_database(patches:patches, high_risk:TRUE);