CVE-2017-10282: Critical severity oracle database vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10282?

CVE-2017-10282 has a critical severity level due to its potential for remote exploitation.

How do I fix CVE-2017-10282?

To fix CVE-2017-10282, apply the appropriate security patch provided by Oracle for affected versions 12.1.0.2 and 12.2.0.1.

Which versions of Oracle Database are affected by CVE-2017-10282?

CVE-2017-10282 affects Oracle Database versions 12.1.0.2 and 12.2.0.1.

Is remote exploitation possible with CVE-2017-10282?

Yes, CVE-2017-10282 is easily exploitable remotely by an authenticated attacker with specific privileges.

What are the prerequisites for exploiting CVE-2017-10282?

An attacker needs Create Session and Execute Catalog Role privileges on the Oracle Database to exploit CVE-2017-10282.