Improper input validation in Oracle Database Server - CVE-2021-2351

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU55044

Improper input validation in Oracle Database Server - CVE-2021-2351

Published: July 20, 2021 / Updated: January 23, 2022


Vulnerability identifier: #VU55044
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-2351
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Advanced Networking Option in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Affected software

Oracle Database Server
Big Data Spatial and Graph
Oracle GoldenGate
Oracle TimesTen In-Memory Database
Oracle ZFS Storage Application Integration Engineering Software
Oracle StorageTek Tape Analytics (STA)
Oracle Banking Enterprise Default Management
Oracle Product Lifecycle Analytics
Oracle Clinical
Oracle Healthcare Data Repository
Oracle Communications Network Integrity
Oracle Communications Design Studio
Oracle Communications IP Service Activator
Oracle Communications Diameter Intelligence Hub
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
Oracle Financial Services Foreign Account Tax Compliance Act Management
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Model Management and Governance
Oracle StorageTek ACSLS
Infrastructure Technology
Oracle Communications Data Model
Oracle Airlines Data Model
Oracle Enterprise Data Quality
Oracle Rapid Planning
Enterprise Manager Base Platform
Oracle Real User Experience Insight
Application Performance Management
Primavera P6 Enterprise Project Portfolio Management
Oracle Banking APIs
Oracle Graph Server and Client
Oracle Blockchain Platform
Oracle Banking Platform
Oracle Utilities Framework
Oracle Communications Network Charging and Control
Oracle iLearning
Oracle Agile Engineering Data Management
Oracle Agile Product Lifecycle Management for Process
Oracle Financial Services Analytical Applications Infrastructure
IBM Emptoris Strategic Supply Management Platform
IBM Emptoris Supplier Lifecycle Management
Oracle Insurance Rules Palette
Oracle FLEXCUBE Private Banking
Oracle FLEXCUBE Investor Servicing
Oracle Policy Automation
Oracle Data Integrator
Oracle Communications User Data Repository
Oracle Application Testing Suite
Oracle Retail Returns Management
Oracle Retail Back Office
Oracle Retail Central Office
Oracle Retail Service Backbone
Oracle Retail Order Broker
Oracle Retail Customer Insights
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
Primavera P6 Professional Project Management
OSS Support Tools
JD Edwards EnterpriseOne Tools
Primavera Unifier
Oracle GoldenGate Application Adapters
Oracle Health Sciences Information Manager
Oracle Health Sciences Clinical Development Analytics
Oracle Thesaurus Management System
Oracle Health Sciences InForm CRF Submit
Oracle Argus Mart
Oracle Argus Insight
Oracle Argus Analytics
PeopleSoft Enterprise PeopleTools
Oracle Fusion Middleware
Oracle Documaker
Oracle Healthcare Translational Research
Oracle Communications Convergent Charging Controller
Oracle Healthcare Foundation
Oracle Hospitality Suite8
Oracle Hospitality Inventory Management
Oracle Communications Pricing Design Center
Oracle Demantra Demand Management
Instantis EnterpriseTrack
Oracle Insurance Insbridge Rating and Underwriting
Oracle Hospitality OPERA 5
Oracle Utilities Testing Accelerator
Oracle Argus Safety
Oracle Insurance Policy Administration
Oracle Retail Price Management
Primavera Data Warehouse
Primavera Analytics
Oracle Communications MetaSolv Solution
Oracle Communications Services Gatekeeper
Oracle Communications Contacts Server
Oracle Communications Calendar Server
Oracle Insurance Data Gateway
Oracle Communications Billing and Revenue Management
Oracle Hospitality Reporting and Analytics
Oracle Agile PLM Framework
Oracle Commerce Platform
Oracle Retail Extract Transform and Load
Oracle Retail Point of Service
Oracle Retail Financial Integration
Oracle Retail Analytics
Oracle Retail Assortment Planning
Oracle Retail Merchandising System
Oracle Retail Order Management System
Oracle WebLogic Server
Oracle Retail Predictive Application Server
Primavera Gateway
Oracle Enterprise Manager Ops Center
Oracle Retail Integration Bus
Siebel UI Framework
Oracle Spatial Studio

How to mitigate CVE-2021-2351

Install updates from vendor's website.

OSS Support Tools - update to 2.12.42
Oracle Insurance Insbridge Rating and Underwriting - update to 5.6.0.0
JD Edwards EnterpriseOne Tools - update to 9.2.6.3
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
Primavera Gateway - addressed in versions 18.8.13, 19.12.12, 20.12.8
Oracle Graph Server and Client - update to 21.4
Oracle Spatial Studio - update to 21.2.1
Oracle GoldenGate - addressed in versions 12.3.0.1.0, 19.1.0.0.220118, 21.5.0.0.220118
Oracle TimesTen In-Memory Database - addressed in versions 21.1.1.1.0, 22.1.1.1.0
Oracle GoldenGate Application Adapters - update to 23.1

External References

Related Security Bulletins