CVE-2018-2841: High severity oracle database vulnerability

Published Apr 19, 2018

Updated

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. While the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Affected Software

4 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18.1.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Event History

Apr 19, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2841?

CVE-2018-2841 is considered a difficult to exploit vulnerability with a medium severity level.

Which versions of Oracle Database are affected by CVE-2018-2841?

Oracle Database versions 11.2.0.4, 12.1.0.2, and 12.2.0.1 are affected by CVE-2018-2841.

How do I fix CVE-2018-2841?

To fix CVE-2018-2841, apply the latest security patches released by Oracle for the affected Database versions.

Can CVE-2018-2841 be exploited remotely?

Yes, CVE-2018-2841 can be exploited remotely by an attacker with low privileges and network access.

What privileges are required to exploit CVE-2018-2841?

Exploitation of CVE-2018-2841 requires the attacker to have Create Session and Create Procedure privileges.