SB2024011655 - Multiple vulnerabilities in Oracle Database Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024011655

SB2024011655 - Multiple vulnerabilities in Oracle Database Server

Published: January 16, 2024 Updated: February 21, 2025

Security Bulletin ID SB2024011655
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2022-21432)

The vulnerability allows a remote privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition RDBMS Security in Oracle Database Server. A remote privileged user can exploit this vulnerability to perform service disruption.


2) Heap-based buffer overflow (CVE-ID: CVE-2023-38545)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the SOCKS5 proxy handshake. A remote attacker can trick the victim to visit a malicious website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that SOCKS5 proxy is used and that SOCKS5 handshake is slow (e.g. under heavy load or DoS attack).


3) Improper input validation (CVE-ID: CVE-2024-20903)

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote authenticated user can exploit this vulnerability to manipulate data.


Remediation

Install update from vendor's website.

References