The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are     affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged     attacker having Export Full Database privilege with network access via Oracle Net to compromise RDBMS     Scheduler. Successful attacks of this vulnerability can result in takeover of RDBMS Scheduler. (CVE-2021-2035)

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Advanced Networking     Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can     result in takeover of Advanced Networking Option. Note: CVE-2021-2018 affects Windows platform only. (CVE-2021-2018)

  - Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are     affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker     having Create Any Procedure, Create Any View, Create Any Trigger privilege with network access via Oracle     Net to compromise RDBMS Sharding. Successful attacks of this vulnerability can result in takeover of RDBMS     Sharding. (CVE-2021-2054)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Database Server Multiple Vulnerabilities (Jan 2021 CPU)

high Nessus Plugin ID 145266

Version 1.7

Version 1.6

Version 1.7 Nov 29, 2024, 9:42 AM CVSS metrics ("CVSSv3 score" set to 8.6) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H") CVSSv3 score source (changed from "CVE-2021-2035" to none) Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202411290942
Version 1.6 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254