Oracle RDBMS (Database and OJVM) Patch Mapping Improvements...

Oracle RDBMS (Database and OJVM) Patch Mapping Improvements

Summary

Improvements have been made to how Nessus plugins determine the active version of the Oracle RDMS’s Database and OJVM components.

How Patch Mapping Works for Oracle Database Scans

Prior to these improvements, the Database and OJVM versions were mapped from installed patches and their corresponding versions via a manually maintained mapping library, oracle_database_mappings.inc. Installed patches are enumerated in one of three possible ways:

Linux Local Detections: oracle_enum_products_nix.bin (plugin ID 71642, requires SSH credentials)
Windows Local Detections: oracle_enum_products_win.nbin (plugin ID 71643, requires SMB credentials)
Direct connection to the Database via oracle_rdbms_query_patch_info.nbin (plugin ID 45642, requires Database credentials)

The patch information is stored by the scanner in a temporary database known as the “scratchpad”, for later reference. Plugin ID 71644, "oracle_rdbms_patch_info.nbin", is then run and sets the patch level (version) by checking the detected patches against the mapping in "oracle_database_mappings.inc".

Problem

This process alone is sometimes problematic, as Oracle releases their patches in stages or sometimes outside of the regular CPU cadence. As this mapping library is manually maintained, some patches were not mapped in time for vulnerability plugin releases, which is a semi-automated process. In the event that the target system has no patches installed that match a mapping from "oracle_database_mappings.inc", only the base version is reported (e.g 21.17.0.0.0), possibly resulting in False Positive findings.

Improvements

As we already have a complete list of installed patches and their descriptions stored in the aforementioned “scratchpad” we have added an additional layer of patch mapping over this. Plugin ID 71644, will now first attempt to parse the patch info directly from the scratchpad and map the installed patches to their corresponding versions based on the patch description. The existing mapping library is still checked, and a version comparison is performed to determine the highest patch level present.

Plugin ID 71644 will now also report the patch levels (version) for the Database and OJVM components in its output.

Expected Impact

Improved accuracy in version detections for Oracle Database and OJVM resulting in less false positives in downstream vulnerability detection plugins

Impacted plugins