Oracle January 2020 CVEs (CVE-2020-2546)

[Sigbjorn]

We have a vendor that cannot patch a system for CVE-2020-2546, does anyone know if there will be a signature available soon?

While looking for this, I see there is a lot of new Oracle exploits being patched, so I assume people are hard at work to create virtual patching.

Ref; https://www.tenable.com/blog/oracle-january-2020-critical-patch-update-contains-255-cves

[_Val_]

Hi @Sigbjorn 

This specific vulnerability does not have a proof of concept or a known exploit in the wild. That means, that for now there isn't enough information in order to develop a protection.

We are constantly monitoring these kind of vulnerabilities, and will provide relevant protections as soon as the required information is available.

[Sigbjorn]

Hi Val,

Thank you for the feedback.

[LeonM]

Hello Val I just stumbled onto this thread, just wanted to check is there any updates in regards to the CVE in question? (CVE-2020-2546)

[_Val_]

No. Without PoC or an exploit, there is no way to provide a signature based protection

[LeonM]

Hey Val,
Alright, thank you for the quick reply