Attacking Oracle Native Network Encryption (CVE-2021-2351)

Показать описание

In this PoC video, an attack against the Oracle Native Network Encryption (NNE) is demonstrated.

This attack allows hijacking authenticated, cryptographically secured connections, and thus gaining access to the Oracle database with the privileges of the targeted victim user.

The security vulnerability exploited in this demo attack was discovered among other security weaknesses by the SySS IT security expert Moritz Bechler during a research project, and reported to Oracle according to our SySS Responsible Disclosure Program [1, 2].

The reported security vulnerabilities have already been fixed by Oracle in the July 2021 Critical Patch Update [3]. The assigned CVE ID concerning the demonstrated security issue and also other security weaknesses is CVE-2021-2351 [4].

The referenced paper titled "Oracle Native Network Encryption: Breaking a Proprietary Security Protocol" written by Moritz Bechler is available at [5].

[1] SySS Security Advisory SYSS-2021-061

[2] SySS Security Advisory SYSS-2021-062

[3] Oracle July 2021 Critical Patch Update (CPU)

[4] CVE-2021-2351

[5] Oracle Native Network Encryption: Breaking a Proprietary Security Protocol, SySS GmbH, Moritz Bechler, 2021

#oracle #security #vulnerability