16 Aug Urgently patch your Oracle database or get held hostage (CVE-2018-3110)!

Posted at 16:15h in Microsoft SQL server, Oracle, Security by

Oracle just released a security alert and is urging users to patch their oracle database installations to plug a critical security issue (this one even got CVSS score 9.9/10, which is really high and shows the importance to patch). The vulnerability can result in a complete compromise of the Oracle Database and shell access to the underlying server. The vulnerability is named “CVE-2018-3110”. But what exactly is the problem and what can you do about it?

The vulnerability affects Oracle Database versions 11.2.0.4 and 12.2.0.1 on Windows and is apparently easy to exploit remotely by an authenticated attacker. The vulnerability is in the Java Virtual Machine (JVM) component of Oracle Database Server. It does not require user interaction and allows attackers, that have received the Create Session privilege with network access via Oracle Net to compromise the component. And even more: an attacker can exploit the vulnerability to attack other technologies as well.

 

The vulnerability also affects Oracle version 12.1.0.2 and version 18 (which was 12.2.0.2) on Windows. Patches for those versions were included in the July 2018 Critical Patch Update (CPU) and so no separate patch on top of the CPU should be installed. The same counts for versions 11.2.0.4, 12.1.0.1, 12.1.0.2 and 18 on Linux and Unix.

The only way to permanently fix the issue is by patching your environment. But what patch should you apply in which situation?

  • Customers running Oracle Database versions 11.2.0.4 or 12.2.0.1 on Windows should apply the patches provided by oracle
  • Customers running versions 12.1.0.2 or 18 on windows should apply the July 2018 Critical Patch Update
  • Customers running versions 11.2.0.4, 12.1.0.2, 12.2.0.1 or 18 on Linux/Unix should also apply the July 2018 Critical Patch Update

As you can see the risk is very high in this vulnerability, so patching is strongly advised. However, also note that the vulnerability can only be used when someone already received access to the database. This shows the importance of having a good security setup of your database environment. Monin can always help to perform an Oracle Database Security Assessment to make sure your database environment follows the security best practices. For more information, check out our Database Assessments.

Do you still have questions about this important vulnerability? Need some help with the installation of the patches? Not sure if you will need to install any patches on your database environment? Just ask us for more information or help about this vulnerability and the solutions.

Some interesting links: