CVE-2021-2351

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS breakdown

Affected products

• oracle / advanced_networking_option12.1.0.2 – 12.1.0.2
• oracle / advanced_networking_option12.2.0.1 – 12.2.0.1
• oracle / advanced_networking_option19c – 19c
• oracle / agile_engineering_data_management6.2.1.0 – 6.2.1.0
• oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
• oracle / agile_product_lifecycle_management_for_process6.2.3.0 – 6.2.3.0
• oracle / agile_product_lifecycle_management_for_process6.2.2.0 – 6.2.2.0
• oracle / airlines_data_model12.1.1.0.0 – 12.1.1.0.0
• oracle / airlines_data_model12.2.0.1.0 – 12.2.0.1.0
• oracle / application_performance_management13.5.1.0 – 13.5.1.0
• oracle / application_performance_management13.4.1.0 – 13.4.1.0
• oracle / Application Testing Suite13.3.0.1 – 13.3.0.1
• oracle / argus_analytics8.2.2 – 8.2.2
• oracle / argus_analytics8.2.3 – 8.2.3
• oracle / argus_analytics8.2.1 – 8.2.1
• oracle / argus_insight8.2.3 – 8.2.3
• oracle / argus_insight8.2.1 – 8.2.1
• oracle / argus_insight8.2.2 – 8.2.2
• oracle / argus_mart8.2.1 – 8.2.1
• oracle / argus_mart8.2.2 – 8.2.2
• oracle / argus_mart8.2.3 – 8.2.3
• oracle / argus_safety8.2.3 – 8.2.3
• oracle / argus_safety8.2.1 – 8.2.1
• oracle / argus_safety8.2.2 – 8.2.2
• oracle / banking_apis19.2 – 19.2
• oracle / banking_apis21.1 – 21.1
• oracle / banking_apis20.1 – 20.1
• oracle / banking_apis18.1 – 18.3
• oracle / banking_apis19.1 – 19.1
• oracle / banking_digital_experience20.1 – 20.1
• oracle / banking_digital_experience19.2 – 19.2
• oracle / banking_digital_experience21.1 – 21.1
• oracle / banking_digital_experience18.1 – 18.3
• oracle / banking_digital_experience17.2 – 17.2
• oracle / banking_digital_experience19.1 – 19.1
• oracle / banking_enterprise_default_management2.10.0 – 2.10.0
• oracle / banking_enterprise_default_management2.12.0 – 2.12.0
• oracle / banking_platform2.7.1 – 2.7.1
• oracle / banking_platform2.6.2 – 2.6.2
• oracle / banking_platform2.12.0 – 2.12.0
• oracle / big_data_spatial_and_graph23.1
• oracle / blockchain_platform21.1.2 – 21.1.2
• oracle / clinical5.2.2 – 5.2.2
• oracle / clinical5.2.1 – 5.2.1
• oracle / commerce_platform11.3.2 – 11.3.2
• oracle / commerce_platform11.3.0 – 11.3.0
• oracle / commerce_platform11.3.1 – 11.3.1
• oracle / communications_application_session_controller3.9.0 – 3.9.0
• oracle / communications_billing_and_revenue_management12.0.0.5 – 12.0.0.5
• oracle / communications_billing_and_revenue_management12.0.0.4 – 12.0.0.4
• oracle / communications_calendar_server8.0.0.5.0 – 8.0.0.5.0
• oracle / communications_contacts_server8.0.0.3.0 – 8.0.0.3.0
• oracle / communications_convergent_charging_controller6.0.1.0.0 – 6.0.1.0.0
• oracle / communications_convergent_charging_controller12.0.1.0.0 – 12.0.4.0.0
• oracle / communications_data_model11.3.2.3.0 – 11.3.2.3.0
• oracle / communications_data_model12.1.2.0.0 – 12.1.2.0.0
• oracle / communications_data_model12.1.0.1.0 – 12.1.0.1.0
• oracle / communications_data_model11.3.2.1.0 – 11.3.2.1.0
• oracle / communications_data_model11.3.2.2.0 – 11.3.2.2.0
• oracle / communications_design_studio7.4.2 – 7.4.2
• oracle / communications_design_studio7.3.5 – 7.3.5
• oracle / communications_design_studio7.4.0 – 7.4.0
• oracle / communications_design_studio7.4.1 – 7.4.1
• oracle / communications_diameter_intelligence_hub8.0.0 – 8.2.3
• oracle / communications_ip_service_activator7.4.0 – 7.4.0
• oracle / communications_metasolv_solution6.3.1 – 6.3.1
• oracle / communications_network_charging_and_control12.0.1.0 – 12.0.4.0.0
• oracle / communications_network_charging_and_control6.0.1.0.0 – 6.0.1.0.0
• oracle / communications_network_integrity7.3.6 – 7.3.6
• oracle / communications_network_integrity7.3.5 – 7.3.5
• oracle / communications_pricing_design_center12.0.0.4 – 12.0.0.4
• oracle / communications_pricing_design_center12.0.0.5 – 12.0.0.5
• oracle / communications_services_gatekeeper7.0 – 7.0
• oracle / communications_session_report_manager8.0.0 – 8.2.5.0
• oracle / communications_session_route_manager8.2.0 – 8.2.5
• oracle / data_integrator12.2.1.4.0 – 12.2.1.4.0
• oracle / data_integrator12.2.1.3.0 – 12.2.1.3.0
• oracle / demantra_demand_management12.2.6 – 12.2.11
• oracle / documaker12.7.0 – 12.7.0
• oracle / documaker12.6.2 – 12.6.4
• oracle / documaker12.6.0 – 12.6.0
• oracle / enterprise_data_quality12.2.1.3.0 – 12.2.1.3.0
• oracle / enterprise_data_quality12.2.1.4.0 – 12.2.1.4.0
• oracle / enterprise_manager_base_platform13.5.0.0 – 13.5.0.0
• oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
• oracle / enterprise_manager_ops_center12.4.0.0 – 12.4.0.0
• oracle / financial_services_analytical_applications_infrastructure8.0.7 – 8.1.1
• oracle / financial_services_behavior_detection_platform8.0.11 – 8.0.11
• oracle / financial_services_behavior_detection_platform8.0.7 – 8.0.7
• oracle / financial_services_behavior_detection_platform8.0.8 – 8.0.8
• oracle / financial_services_enterprise_case_management8.0.7 – 8.0.7
• oracle / financial_services_enterprise_case_management8.0.8 – 8.0.8
• oracle / financial_services_enterprise_case_management8.0.11 – 8.0.11
• oracle / financial_services_foreign_account_tax_compliance_act_management8.0.11 – 8.0.11
• oracle / financial_services_foreign_account_tax_compliance_act_management8.0.7 – 8.0.7
• oracle / financial_services_foreign_account_tax_compliance_act_management8.0.8 – 8.0.8
• oracle / financial_services_model_management_and_governance8.0.8.0.0 – 8.1.1.0.0
• oracle / financial_services_trade-based_anti_money_laundering8.0.7 – 8.0.7
• oracle / financial_services_trade-based_anti_money_laundering8.0.8 – 8.0.8
• oracle / FLEXCUBE Investor Servicing14.4.0 – 14.4.0
• oracle / FLEXCUBE Investor Servicing12.4.0 – 12.4.0
• oracle / FLEXCUBE Investor Servicing14.5.0 – 14.5.0
• oracle / FLEXCUBE Investor Servicing12.0.4 – 12.0.4
• oracle / FLEXCUBE Investor Servicing12.1.0 – 12.1.0
• oracle / FLEXCUBE Investor Servicing12.3.0 – 12.3.0
• oracle / FLEXCUBE Private Banking12.0.0 – 12.0.0
• oracle / FLEXCUBE Private Banking12.1.0 – 12.1.0
• oracle / fusion_middleware12.2.1.4.0 – 12.2.1.4.0
• oracle / fusion_middleware12.2.1.3.0 – 12.2.1.3.0
• oracle / goldengate12.3.0.1.0
• oracle / goldengate_application_adapters23.1
• oracle / graph_server_and_client21.4.0
• oracle / healthcare_data_repository7.0.2 – 7.0.2
• oracle / healthcare_data_repository8.1.0 – 8.1.0
• oracle / healthcare_data_repository8.1.1 – 8.1.1
• oracle / healthcare_foundation7.3.0 – 7.3.0.2
• oracle / healthcare_translational_research4.1.0 – 4.1.0
• oracle / health_sciences_clinical_development_analytics4.0.1 – 4.0.1
• oracle / health_sciences_information_manager3.0.2 – 3.0.2
• oracle / health_sciences_information_manager3.0.3 – 3.0.3
• oracle / health_sciences_inform_crf_submit6.2.1 – 6.2.1
• oracle / hospitality_inventory_management9.1.0
• oracle / hospitality_inventory_management9.1.0 – 9.1.0
• oracle / hospitality_opera_55.6 – 5.6
• oracle / hospitality_reporting_and_analytics9.1.0 – 9.1.0
• oracle / hospitality_suite88.12.0 – 8.12.0
• oracle / hospitality_suite88.14.0 – 8.14.0
• oracle / hospitality_suite88.13.0 – 8.13.0
• oracle / hospitality_suite88.10.2 – 8.10.2
• oracle / hospitality_suite88.11.0 – 8.11.0
• oracle / hyperion_infrastructure_technology11.2.7.0 – 11.2.7.0
• oracle / ilearning6.3 – 6.3
• oracle / ilearning6.2 – 6.2
• oracle / instantis_enterprisetrack17.2 – 17.2
• oracle / instantis_enterprisetrack17.1 – 17.1
• oracle / instantis_enterprisetrack17.3 – 17.3
• oracle / insurance_data_gateway11.1.0 – 11.1.0
• oracle / insurance_data_gateway11.3.1 – 11.3.1
• oracle / insurance_data_gateway11.3.0 – 11.3.0
• oracle / insurance_data_gateway11.0.2 – 11.0.2
• oracle / insurance_data_gateway11.2.7 – 11.2.7
• oracle / insurance_insbridge_rating_and_underwriting5.4 – 5.6.0
• oracle / insurance_insbridge_rating_and_underwriting5.2.0 – 5.2.0
• oracle / insurance_policy_administration11.2.7 – 11.2.7
• oracle / insurance_policy_administration11.3.0 – 11.3.0
• oracle / insurance_policy_administration11.3.1 – 11.3.1
• oracle / insurance_policy_administration11.0.2 – 11.0.2
• oracle / insurance_policy_administration11.1.0 – 11.1.0
• oracle / insurance_rules_palette11.2.7 – 11.2.7
• oracle / insurance_rules_palette11.3.1 – 11.3.1
• oracle / insurance_rules_palette11.3.0 – 11.3.0
• oracle / insurance_rules_palette11.0.2 – 11.0.2
• oracle / insurance_rules_palette11.1.0 – 11.1.0
• oracle / jd_edwards_enterpriseone_tools9.2.6.3 – 9.2.6.3
• oracle / oss_support_tools2.12.42
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
• oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
• oracle / policy_automation12.2.0 – 12.2.24
• oracle / primavera_analytics19.12.11.1 – 19.12.11.1
• oracle / primavera_analytics20.12.12.0 – 20.12.12.0
• oracle / primavera_analytics18.8.3.3 – 18.8.3.3
• oracle / primavera_data_warehouse20.12.12.0 – 20.12.12.0
• oracle / primavera_data_warehouse18.8.3.3 – 18.8.3.3
• oracle / primavera_data_warehouse19.12.11.1 – 19.12.11.1
• oracle / primavera_gateway17.12.0 – 17.12.11
• oracle / primavera_p6_enterprise_project_portfolio_management17.12.0.0 – 17.12.20
• oracle / primavera_p6_professional_project_management17.12 – 17.12.20.0
• oracle / primavera_unifier21.12 – 21.12
• oracle / primavera_unifier20.12 – 20.12
• oracle / primavera_unifier19.12 – 19.12
• oracle / primavera_unifier17.7 – 17.12
• oracle / primavera_unifier18.8 – 18.8
• oracle / product_lifecycle_analytics3.6.1 – 3.6.1
• oracle / rapid_planning12.2.6 – 12.2.11
• oracle / real_user_experience_insight13.5.1.0 – 13.5.1.0
• oracle / real_user_experience_insight13.4.1.0 – 13.4.1.0
• oracle / retail_analytics16.0.0 – 16.0.2
• oracle / retail_assortment_planning16.0.3 – 16.0.3
• oracle / retail_back_office14.1 – 14.1
• oracle / retail_central_office14.1 – 14.1
• oracle / retail_customer_insights16.0 – 16.0.2
• oracle / retail_extract_transform_and_load13.2.8 – 13.2.8
• oracle / retail_financial_integration14.1.3.2 – 14.1.3.2
• oracle / retail_financial_integration16.0.3.0 – 16.0.3.0
• oracle / retail_financial_integration19.0.1 – 19.0.1
• oracle / retail_financial_integration15.0.3.1 – 15.0.3.1
• oracle / retail_integration_bus15.0.3.1 – 15.0.3.1
• oracle / retail_integration_bus19.0.1 – 19.0.1
• oracle / retail_integration_bus16.0.3 – 16.0.3
• oracle / retail_integration_bus14.1.3.2 – 14.1.3.2
• oracle / retail_merchandising_system19.0.1 – 19.0.1
• oracle / retail_order_broker16.0 – 16.0
• oracle / retail_order_broker19.1 – 19.1
• oracle / retail_order_broker18.0 – 18.0
• oracle / retail_order_management_system19.5 – 19.5
• oracle / retail_point-of-service14.1 – 14.1
• oracle / retail_predictive_application_server16.0.3 – 16.0.3
• oracle / retail_predictive_application_server15.0.3 – 15.0.3
• oracle / retail_predictive_application_server14.1.3 – 14.1.3
• oracle / retail_price_management14.1 – 14.1
• oracle / retail_price_management16.0 – 16.0
• oracle / retail_price_management15.0 – 15.0
• oracle / retail_returns_management14.1 – 14.1
• oracle / retail_service_backbone14.1.3.2 – 14.1.3.2
• oracle / retail_service_backbone15.0.3.1 – 15.0.3.1
• oracle / retail_service_backbone16.0.3 – 16.0.3
• oracle / retail_service_backbone19.0.1 – 19.0.1
• oracle / retail_store_inventory_management14.1 – 14.1
• oracle / retail_store_inventory_management15.0 – 15.0
• oracle / retail_store_inventory_management16.0 – 16.0
• oracle / retail_xstore_point_of_service18.0.3 – 18.0.3
• oracle / retail_xstore_point_of_service17.0.4 – 17.0.4
• oracle / retail_xstore_point_of_service20.0.1 – 20.0.1
• oracle / retail_xstore_point_of_service19.0.2 – 19.0.2
• oracle / Siebel UI Framework21.12
• oracle / spatial_studio21.2.1
• oracle / storagetek_acsls8.5.1 – 8.5.1
• oracle / storagetek_tape_analytics2.4 – 2.4
• oracle / thesaurus_management_system5.3.0 – 5.3.0
• oracle / thesaurus_management_system5.2.3 – 5.2.3
• oracle / thesaurus_management_system5.3.1 – 5.3.1
• oracle / timesten_in-memory_database21.1.1.1.0
• oracle / timesten_in-memory_database21.1.1.1.0 – 21.1.1.1.0
• oracle / utilities_framework4.4.0.3.0 – 4.4.0.3.0
• oracle / utilities_framework4.2.0.3.0 – 4.2.0.3.0
• oracle / utilities_framework4.4.0.0.0 – 4.4.0.0.0
• oracle / utilities_framework4.4.0.2.0 – 4.4.0.2.0
• oracle / utilities_framework4.3.0.1.0 – 4.3.0.6.0
• oracle / utilities_testing_accelerator6.0.0.2.2 – 6.0.0.2.2
• oracle / utilities_testing_accelerator6.0.0.3.1 – 6.0.0.3.1
• oracle / utilities_testing_accelerator6.0.0.1.1 – 6.0.0.1.1
• oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
• oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
• oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
• oracle / zfs_storage_application_integration_engineering_software1.3.3 – 1.3.3
• Oracle Corporation / WebLogic Server12.2.1.3.0 – 12.2.1.3.0
• Oracle Corporation / WebLogic Server12.2.1.4.0 – 12.2.1.4.0
• Oracle Corporation / WebLogic Server14.1.1.0.0 – 14.1.1.0.0

References

• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Dec/19
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Dec/20
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• EXPLOIThttp://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html
• EXPLOIThttp://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2023.html