CVE-2021-2351

Q: What is the severity of CVE-2021-2351?

CVE-2021-2351 has a CVSS score of 8.3 (HIGH). This vulnerability in Oracle Database's Advanced Networking Option allows attackers to bypass network encryption protections and potentially compromise the component. It affects Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c with Advanced Networking Option enabled. Successful exploitation requires network access via Oracle Net and human interaction from someone other than the attacker.

8.3 HIGH

📋 TL;DR

This vulnerability in Oracle Database's Advanced Networking Option allows attackers to bypass network encryption protections and potentially compromise the component. It affects Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c with Advanced Networking Option enabled. Successful exploitation requires network access via Oracle Net and human interaction from someone other than the attacker.

💻 Affected Systems

Products:

Oracle Database Server with Advanced Networking Option

Versions: 12.1.0.2, 12.2.0.1, 19c

Operating Systems: All platforms running affected Oracle Database versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Advanced Networking Option to be enabled and configured with vulnerable cipher settings.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete takeover of the Advanced Networking Option component, potentially leading to full database compromise, data exfiltration, and system control.

🟠

Likely Case

Bypass of network encryption protections, allowing attackers to intercept or manipulate database communications.

🟢

If Mitigated

Limited impact with proper network segmentation, encryption enforcement, and updated cipher configurations.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires human interaction (social engineering) and specific network conditions. Public exploit details available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: July 2021 Critical Patch Update and later

Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2022.html

Restart Required: Yes

Instructions:

1. Apply Oracle Critical Patch Update from July 2021 or later. 2. Review and implement Native Network Encryption changes per Oracle Doc ID 2791571.1. 3. Restart database services.

🔧 Temporary Workarounds

Disable weak ciphers

all

Configure Native Network Encryption to use only strong ciphers and disable vulnerable cipher suites.

SQL> ALTER SYSTEM SET SQLNET.ENCRYPTION_TYPES_SERVER = (AES256) SCOPE=BOTH;
SQL> ALTER SYSTEM SET SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256) SCOPE=BOTH;

Network segmentation

all

Restrict network access to Oracle Database ports (typically 1521) to trusted sources only.

🧯 If You Can't Patch

Implement strict network access controls and firewall rules to limit Oracle Net connections
Enable comprehensive logging and monitoring for unusual database network activity

🔍 How to Verify

Check if Vulnerable:

Check Oracle Database version and patch level: SQL> SELECT * FROM v$version; and SQL> SELECT * FROM dba_registry_history;

Check Version:

SQL> SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';

Verify Fix Applied:

Verify patch applied: SQL> SELECT comments FROM dba_registry_history WHERE action_time > '01-JUL-2021'; and check cipher configuration.

📡 Detection & Monitoring

Log Indicators:

Unusual network encryption negotiation failures
Multiple connection attempts with different cipher suites
Oracle Net protocol anomalies

Network Indicators:

Unusual traffic patterns on Oracle Net ports
Attempts to negotiate weak encryption ciphers
Suspicious database connection attempts

SIEM Query:

source="oracle_audit.log" AND (event="NETWORK_ENCRYPTION_FAILURE" OR cipher_suite="*weak*")

📊 Metadata

CVE ID: CVE-2021-2351

CVSS v3 Score: 8.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE: CWE-327

Published: July 21, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2021/Dec/19 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2021/Dec/20 Exploit,Mailing List,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2023.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Vendor Advisory
http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2021/Dec/19 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2021/Dec/20 Exploit,Mailing List,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2023.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html Patch,Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Advanced Networking Option by Oracle

Advanced Networking Option by Oracle

Advanced Networking Option by Oracle

Agile Engineering Data Management by Oracle

Agile Plm by Oracle

Agile Product Lifecycle Management For Process by Oracle

Agile Product Lifecycle Management For Process by Oracle

Airlines Data Model by Oracle

Airlines Data Model by Oracle

Application Performance Management by Oracle

Application Performance Management by Oracle

Application Testing Suite by Oracle

Argus Analytics by Oracle

Argus Analytics by Oracle

Argus Analytics by Oracle

Argus Insight by Oracle

Argus Insight by Oracle

Argus Insight by Oracle

Argus Mart by Oracle

Argus Mart by Oracle

Argus Mart by Oracle

Argus Safety by Oracle

Argus Safety by Oracle

Argus Safety by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Apis by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Enterprise Default Management by Oracle

Banking Enterprise Default Management by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Big Data Spatial And Graph by Oracle

Blockchain Platform by Oracle

Clinical by Oracle

Clinical by Oracle

Commerce Platform by Oracle

Commerce Platform by Oracle

Commerce Platform by Oracle

Communications Application Session Controller by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Communications Calendar Server by Oracle

Communications Contacts Server by Oracle

Communications Convergent Charging Controller by Oracle

Communications Convergent Charging Controller by Oracle

Communications Data Model by Oracle

Communications Data Model by Oracle

Communications Data Model by Oracle

Communications Data Model by Oracle

Communications Data Model by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Diameter Intelligence Hub by Oracle

Communications Ip Service Activator by Oracle

Communications Metasolv Solution by Oracle

Communications Network Charging And Control by Oracle

Communications Network Charging And Control by Oracle

Communications Network Integrity by Oracle

Communications Network Integrity by Oracle

Communications Pricing Design Center by Oracle

Communications Pricing Design Center by Oracle

Communications Services Gatekeeper by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Data Integrator by Oracle

Data Integrator by Oracle