Login Sign Up

CVE-2021-35599

8.2 HIGH

📋 TL;DR

This vulnerability in Oracle Database Server's Zero Downtime DB Migration to Cloud component allows high-privileged local attackers to completely compromise the migration service. It affects Oracle Database Server version 21c, potentially impacting additional products connected to the migration service. Successful exploitation can lead to full takeover of the migration component with confidentiality, integrity, and availability impacts.

💻 Affected Systems

Products:
  • Oracle Database Server
Versions: 21c
Operating Systems: All platforms running Oracle Database 21c
Default Config Vulnerable: ⚠️ Yes
Notes: Specifically affects the Zero Downtime DB Migration to Cloud component. Requires local logon privilege to the infrastructure where the component executes.

📦 What is this software?

Zero Downtime Db Migration To Cloud by Oracle

View all CVEs affecting Zero Downtime Db Migration To Cloud →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the Zero Downtime DB Migration to Cloud service, potentially leading to data exfiltration, database manipulation, service disruption, and lateral movement to connected systems.

🟠

Likely Case

Privileged local attacker gains control over the migration service, potentially disrupting database migration operations and accessing sensitive migration data.

🟢

If Mitigated

Limited impact due to proper access controls, network segmentation, and monitoring preventing local attackers from reaching the vulnerable component.

🌐 Internet-Facing: LOW - The vulnerability requires local access to the infrastructure where the component executes.
🏢 Internal Only: HIGH - High-privileged local attackers can exploit this vulnerability to compromise the migration service.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW - CVSS indicates low attack complexity but requires high privileges.

Exploitation requires local access with high privileges. No public exploit code has been disclosed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update October 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpuoct2021.html

Restart Required: Yes

Instructions:

1. Download the appropriate patch from My Oracle Support. 2. Apply the patch following Oracle's patching procedures. 3. Restart affected database services. 4. Verify the patch was applied successfully.

🔧 Temporary Workarounds

Restrict Local Access

all

Limit local logon access to the infrastructure where Zero Downtime DB Migration to Cloud executes to only necessary administrative users.

Disable Unused Component

all

If Zero Downtime DB Migration to Cloud is not required, disable or remove the component.

🧯 If You Can't Patch

  • Implement strict access controls to limit local logon privileges to only essential administrators
  • Monitor for suspicious activity related to the Zero Downtime DB Migration to Cloud component

🔍 How to Verify

Check if Vulnerable:

Check Oracle Database version: SELECT * FROM v$version; If version is 21c and patch from October 2021 CPU is not applied, system is vulnerable.

Check Version:

SELECT * FROM v$version;

Verify Fix Applied:

Verify patch application through Oracle's opatch utility: opatch lsinventory | grep -i 'October 2021'

📡 Detection & Monitoring

Log Indicators:

  • Unusual activity in Zero Downtime DB Migration to Cloud logs
  • Unauthorized access attempts to migration service
  • Unexpected process execution related to migration component

Network Indicators:

  • Unusual network traffic from database server to migration endpoints
  • Unexpected connections to migration service ports

SIEM Query:

source="oracle_database" AND (event_type="migration_service_access" OR component="Zero Downtime DB Migration") AND status="failed"

📊 Metadata

CVE ID: CVE-2021-35599
CVSS v3 Score: 8.2 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: October 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON