Vulnerability Name:

CVE-2021-2018 (CCN-195119)

Assigned:2020-12-09
Published:2021-01-19
Updated:2021-01-25
Summary:Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option.
Note: CVE-2021-2018 affects Windows platform only. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS v3 Severity:8.3 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
7.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
7.2 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Other
References:Source: MITRE
Type: CNA
CVE-2021-2018

Source: XF
Type: UNKNOWN
oracle-cpujan2021-cve20212018(195119)

Source: CCN
Type: IBM Security Bulletin 6440925 (Emptoris Contract Management)
Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Contract Management

Source: CCN
Type: IBM Security Bulletin 6440927 (Emptoris Strategic Supply Management)
Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform

Source: CCN
Type: IBM Security Bulletin 6440929 (Emptoris Program Management)
Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Program Management

Source: CCN
Type: IBM Security Bulletin 6440931 (Emptoris Supplier Lifecycle Management)
Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Source: CCN
Type: IBM Security Bulletin 6440933 (Emptoris Sourcing)
Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing

Source: CCN
Type: Oracle CPUJan2021
Oracle Critical Patch Update Advisory - January 2021

Source: MISC
Type: Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:advanced_networking_option:18c:*:*:*:*:*:*:.
  • OR cpe:/a:oracle:advanced_networking_option:19c:*:*:*:*:*:*:.
  • AND
  • cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:oracle:adaptive_access_manager:11.1.2.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:data_integrator:11.1.1.9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_manager_for_fusion_applications:13.3.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_simphony:18.2.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_simphony:19.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:database_server:18c:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:database_server:19c:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:emptoris_sourcing:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_sourcing:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_contract_management:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_sourcing:10.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_contract_management:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_contract_management:10.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_program_management:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_program_management:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_program_management:10.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_supplier_lifecycle_management:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_supplier_lifecycle_management:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_supplier_lifecycle_management:10.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle advanced networking option 18c
    oracle advanced networking option 19c
    microsoft windows -
    oracle adaptive access manager 11.1.2.3.0
    oracle data integrator 11.1.1.9.0
    oracle data integrator 12.2.1.3.0
    oracle data integrator 12.2.1.4.0
    oracle enterprise manager for fusion applications 13.3.0.0
    oracle hospitality simphony 18.2.7.2
    oracle hospitality simphony 19.1.3
    oracle weblogic server 12.2.1.3.0
    oracle database server 18c
    oracle database server 19c
    ibm emptoris sourcing 10.1.0
    ibm emptoris sourcing 10.1.1
    ibm emptoris contract management 10.1.0
    ibm emptoris sourcing 10.1.3
    ibm emptoris contract management 10.1.1
    ibm emptoris contract management 10.1.3
    ibm emptoris program management 10.1.0
    ibm emptoris program management 10.1.1
    ibm emptoris program management 10.1.3
    ibm emptoris supplier lifecycle management 10.1.0
    ibm emptoris supplier lifecycle management 10.1.1
    ibm emptoris supplier lifecycle management 10.1.3
    ibm emptoris strategic supply management 10.1.0
    ibm emptoris strategic supply management 10.1.1
    ibm emptoris strategic supply management 10.1.3