SB2022012312 - Multiple vulnerabilities in Oracle TimesTen In-Memory Database

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022012312

SB2022012312 - Multiple vulnerabilities in Oracle TimesTen In-Memory Database

Published: January 23, 2022

Security Bulletin ID SB2022012312
Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-11979)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect patch for vulnerability #VU27924 (CVE-2020-1945). Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.


2) Improper input validation (CVE-ID: CVE-2020-7712)

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Reports (Apache ZooKeeper) component in Oracle Financial Services Regulatory Reporting with AgileREPORTER. A remote privileged user can exploit this vulnerability to execute arbitrary code.


3) Input validation error (CVE-ID: CVE-2021-29923)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in net.ParseIP and net.ParseCIDR, as the Go interpreter does not properly consider extraneous zero characters at the beginning of an IP address octet. A remote attacker can bypass access control that is based on IP addresses, because of unexpected octal interpretation.


4) Improper input validation (CVE-ID: CVE-2021-2351)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Advanced Networking Option in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Remediation

Install update from vendor's website.

References