CVE-2023-34363 : Security Advisory and Response

An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle that could lead to decryption of traffic between the driver and the database server.

Understanding CVE-2023-34363

This CVE identifies a vulnerability in Progress DataDirect Connect for ODBC affecting Oracle users.

What is CVE-2023-34363?

The vulnerability arises when initializing the encryption object in Oracle Advanced Security (OAS) encryption, resulting in the use of an insecure random number generator if errors occur. This can allow attackers to predict the generator's output and potentially decrypt traffic.

The Impact of CVE-2023-34363

If exploited, this vulnerability could enable attackers to intercept and decrypt data transmitted between the ODBC driver and the Oracle database server when using Oracle Advanced Security encryption.

Technical Details of CVE-2023-34363

This section delves into the specific technical aspects of the CVE.

Vulnerability Description

The issue occurs when the encryption object initialization fails, leading to the use of a vulnerable random number generator for key generation, making it possible for attackers to decrypt data.

Affected Systems and Versions

All versions of Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle are impacted by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by predicting the output of the random number generator used to generate the private key, allowing them to decrypt traffic.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-34363, immediate actions and long-term security measures are essential.

Immediate Steps to Take

Users are advised to implement SSL/TLS encryption instead of Oracle Advanced Security to prevent exploitation of this vulnerability.

Long-Term Security Practices

Regular security updates, monitoring for any unusual activity, and staying informed about patches and fixes are crucial for maintaining robust cybersecurity.

Patching and Updates

It is recommended to update to version 08.02.2770 or newer of Progress DataDirect Connect for ODBC for Oracle to address this vulnerability and enhance overall security.