CVE-2020-2978: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2020-2978 is a vulnerability in the Oracle Database - Enterprise Edition component affecting versions 12.1.0.2, 12.2.0.1, 18c, and 19c. The vulnerability was disclosed in July 2020 as part of Oracle's Critical Patch Update. It allows high privileged attackers with DBA role account privileges and network access via Oracle Net to compromise Oracle Database - Enterprise Edition (Oracle CPU Jul2020).

This vulnerability is related to RMAN (Recovery Manager) audit table point-in-time recovery operations not being properly logged in the audit trails. Despite RMAN operations being audited by default in Unified Auditing mode, the table point-in-time recovery activity was not logged in the audit logs. The vulnerability has a CVSS 3.1 Base Score of 4.1 (Integrity impacts) with the vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) (Database Security Ninja, Oracle CPU Jul2020).

The vulnerability impacts the integrity of audit trails for sensitive table operations. When exploited, it could result in unauthorized update, insert or delete access to some Oracle Database - Enterprise Edition accessible data, while leaving no audit trail of the recovery operations. This makes forensic investigation or real-time security operations monitoring for activities against highly confidential sensitive tables challenging (Database Security Ninja).

The vulnerability is easily exploitable but requires a high-privileged attacker having DBA role account privileges with network access via Oracle Net. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products (Oracle CPU Jul2020).

Oracle addressed this vulnerability in the July 2020 Critical Patch Update. After applying the patch, RMAN operations are properly logged in the audit trails. Organizations should apply the relevant security patches to affected versions: 12.1.0.2, 12.2.0.1, 18c, and 19c (Oracle CPU Jul2020).

The vulnerability was discovered and reported by Emad Al-Mousa of Saudi Aramco (Oracle CPU Jul2020).