Risk: Medium
Oracle’s Concurrent Manager server, the standard database server for Oracle and also the front end, contains a vulnerability within the FNDFS file server within it that is used by the RRA (Report Review Agent) when retrieving reports or logs.
The flaw allows an attacker with access to an Oracle SQL*Net port to retrieve any file from the Oracle system, bypassing all authentication checks. Such file access could allow the attacker to retrieve critical files, such as those containing valid username/password combinations, to become a stepping stone on the route to full compromise. Enterprises which have a Firewall blocking external access to SQL*Net ports will not be vulnerable, except from an internal attack. Oracle have released a patch which adds a new security layer.