10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.008 Low
EPSS
Percentile
81.4%
Oracle Transparent Data Encryption master encryption key is stored as plaintext, which could allow an attacker to decrypt and read sensitive information within the database.
Transparent Data Encryption (TDE)
According to Oracle, Transparent Data Encryption “allows customers to encrypt sensitive data in columns without having to manage the encryption key … Oracle eliminates the need for views to decrypt data, because the data is transparently decrypted once a user has passed necessary access-control checks.”
System Global Area (SGA)
The SGA is memory allocated by an instance of an Oracle database to store and share data among database processes and users.
The Problem
The master encryption key used by TDE is stored as plaintext in the SGA.
Based on research into public information, we believe that this issue is Oracle vuln# DB27 in the Oracle CPU for January 2006. However, there is not sufficient information to authoritatively relate Oracle vulnerability information to information provided by other parties.
If an attacker can gain access to SGA memory, that attacker may be able to retrieve the TDE master key. Once the key is obtained, the attacker will be able to decrypt and read sensitive information within the database.
Apply patches
This issue is corrected in the Oracle Critical Patch Update for January 2006.
857412
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: January 19, 2006
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see <http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html>
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23857412 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerabilty was reported by Alexander Kornbrust of red-database security.
This document was written by Jeff Gennari.
CVE IDs: | CVE-2006-0270 |
---|---|
Severity Metric: | 4.78 Date Public: |