SB2020102104 - Multiple vulnerabilities in Oracle Database Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020102104

SB2020102104 - Multiple vulnerabilities in Oracle Database Server

Published: October 21, 2020

Security Bulletin ID SB2020102104
Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 18% Medium 27% Low 55%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2020-14742)

The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Core RDBMS in Oracle Database Server. A remote privileged user can exploit this vulnerability to manipulate data.


2) Improper input validation (CVE-ID: CVE-2020-14740)

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the SQL Developer Install in Oracle Database Server. A local authenticated user can exploit this vulnerability to gain access to sensitive information.


3) Improper input validation (CVE-ID: CVE-2020-14743)

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote authenticated user can exploit this vulnerability to manipulate data.


4) Improper input validation (CVE-ID: CVE-2020-14736)

The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Database Vault in Oracle Database Server. A remote privileged user can exploit this vulnerability to read and manipulate data.


5) Improper input validation (CVE-ID: CVE-2020-14901)

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the RDBMS Security in Oracle Database Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.


6) Improper input validation (CVE-ID: CVE-2020-14741)

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Database Filesystem in Oracle Database Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.


7) Cross-site scripting (CVE-ID: CVE-2020-11023)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when passing <option> elements to jQuery’s DOM manipulation methods. A remote attacker can execute arbitrary JavaScript code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


8) Infinite loop (CVE-ID: CVE-2020-13935)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing payload length in a WebSocket frame. A remote attacker can send a specially crafted request to the application, consume all available system resources and cause denial of service conditions.


9) Improper input validation (CVE-ID: CVE-2020-14734)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Oracle Text in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


10) Improper input validation (CVE-ID: CVE-2020-14735)

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Scheduler in Oracle Database Server. A local authenticated user can exploit this vulnerability to execute arbitrary code.


11) Out-of-bounds write (CVE-ID: CVE-2019-12900)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the BZ2_decompress() function in decompress.c. A remote attacker can create a specially crafted archive, trick the victim into opening it using the affected library, trigger out-of-bounds write and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References