Oracle Security Vulnerability Scoring Metric Change (CVSS)
No, Oracle security vulnerabilities didn’t just get a whole lot worse this quarter. Instead, Oracle updated the scoring metric used in the Critical Patch Updates (CPU) from CVSS v2 to CVSS v3.0 for the April 2016 CPU. The Common Vulnerability Score System (CVSS) is a generally accepted method for scoring and rating security vulnerabilities. CVSS is used by Oracle, Microsoft, Cisco, and other major software vendors.
As we have discussed previously, CVSS v2 did score Oracle security vulnerabilities for the database, middleware, and applications lower than operating system and network component vulnerabilities. Contrary to what many security researchers claim, the problem is with the CVSS standard, not manipulation of the scores by Oracle. CVSS v2 puts a premium on the ability to compromise the entire operating system (i.e., root account) or device. For most Oracle security vulnerabilities, across all products, it is very difficult to compromise the root operating system account by exploiting an Oracle Database, Fusion Middleware, or application (Oracle E-Business Suite, PeopleSoft, etc.) security bug. Although, there are some exceptions mostly limited to the Oracle Database running on Microsoft Windows Server, which allow compromise of the administrator account.
To account for this limitation in CVSS, Oracle included in the CPU advisory matrices for informational purposes only a “Partial+” to indicate where the entire database, middleware server, or application could be compromised. However, this was not reflected in the score since the CVSS standard says a “Complete” impact “… is total information disclosure, resulting in all system files being revealed.” As a result, Oracle CVSS v2 scores for critical or severe bugs tended to be 6.5 for the Oracle Database, 7.5 for Fusion Middleware, and 6.4 for applications like the Oracle E-Business Suite and PeopleSoft.
CVSS v3.0 changes the scoring to put more of an emphasis on the asset or component being protected (i.e., database or application). The key CVSS definition has changed from “system” to “impacted component.” The scoring algorithm also includes more granularity for privileges required to exploit and the scope of the exploit, such as can a database attack compromise the underlying operating system.
The Oracle CVSS v3.0 scores will be much higher now, especially for the Fusion Middleware and applications like Oracle E-Business Suite and PeopleSoft. Critical Fusion Middleware security bugs will rise from 7.5 to 9.8. Oracle E-Business Suite and PeopleSoft critical security bugs like unauthenticated SQL injection will jump from 6.4 to 9.8. As almost all Oracle Database security bugs require database authentication, the Oracle Database CVSS scores will go from 6.5 to 8.8 for easy to exploit SQL injection vulnerabilities in PUBLIC packages.
The critical risk associated with most Oracle security vulnerabilities is still critical. Now the CVSS score properly reflects the critical nature of many of these bugs.