Vulnerability in the Advanced Networking Option component of… (CVE-2021-2351, CVSS 8.3)

Summary

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Su...

Original description

The description as published by the source.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

この脆弱性は、Oracle Database ServerのAdvanced Networking Optionコンポーネントに存在し、バージョン12.1.0.2、12.2.0.1、19cが影響を受けます。ネットワーク経由の攻撃者が、認証なしにこのコンポーネントを侵害する可能性があります。成功した攻撃は、システムの機密性、完全性、および可用性に重大な影響を及ぼします。この脆弱性に対処するため、Oracleは暗号化方式の強化を図った更新を提供しました。

❓ What is the problem

Oracle Database ServerのAdvanced Networking Optionにおける脆弱性。

📍 Affected scope

バージョン12.1.0.2、12.2.0.1、19cのOracle Database ServerのAdvanced Networking Option。

🔥 Severity

この脆弱性は、高い重要度で機密性、完全性、可用性に影響を与えます。攻撃には他者の人為的な操作が必要です。

🔧 How to fix

Oracleの「2021年7月クリティカルパッチアップデート」を導入し、暗号化方式の強化により修正。

🛡️ Workaround

情報なし

🔍 Detection

Oracle Database Serverの該当バージョン使用時には、ネットワークアクセス状況を確認し、クリティカルパッチアップデートの適用を確認。

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Summary

Original description

AI summary

References