SB2022042536 - Multiple vulnerabilities in Oracle StorageTek Tape Analytics (STA)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022042536

SB2022042536 - Multiple vulnerabilities in Oracle StorageTek Tape Analytics (STA)

Published: April 25, 2022

Security Bulletin ID SB2022042536
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-11979)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect patch for vulnerability #VU27924 (CVE-2020-1945). Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.


2) Improper input validation (CVE-ID: CVE-2021-2351)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Advanced Networking Option in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Remediation

Install update from vendor's website.

References