A newly discovered vulnerability in Oracle’s Transparent Network Substrate (TNS) protocol allows remote attackers to access sensitive system memory without authentication. This flaw, tracked as CVE-2025-30733, affects multiple versions of Oracle Database Server.
Oracle released a patch on April 15, 2025. The issue affects versions 19.3 to 19.26, 21.3 to 21.17, and 23.4 to 23.7. It carries a CVSS v3.1 score of 6.5, indicating a medium-severity threat.
Memory Leak Through Oracle TNS Listener
Security researchers from Driftnet discovered the flaw while testing TNS listeners using version requests. When sent over TCPS (TNS over SSL/TLS), some Oracle servers responded with unintended memory data.
The leaked data included uninitialized memory content such as:
- Windows environment variables (e.g., USERDOMAIN, USERNAME)
- Local file paths and session data
- Prefixes such as “sdp” and “wss” suggesting Session Description Protocol and Web Services Security involvement
The vulnerability is tied to how Oracle handles memory in TCPS responses. A failure to clear memory before sending it causes fragments of past data to be exposed to unauthenticated users.
Vulnerability Scope and Risk
Although Oracle has restricted external access since version 10g, researchers still found around 40 exposed servers online. Most of them were running Windows and used the default TNS listener port (1521).
The exposure depends on the LOCAL_OS_AUTHENTICATION setting. If it is set to OFF, the system allows remote connections, making the vulnerability exploitable.
Risk Summary
- Affected Products: Oracle Database Server RDBMS Listener (19.3–19.26, 21.3–21.17, 23.4–23.7)
- Impact: Unauthorized access to sensitive memory
- Requirements: Remote access to TNS listener, non-default configuration, user interaction
- CVSS 3.1 Score: 6.5 (Medium)
Mitigation and Recommendations
Oracle has addressed this issue in the April 2025 Critical Patch Update. Administrators are urged to apply the patch immediately.
Organizations should also:
- Verify the LOCAL_OS_AUTHENTICATION parameter is set correctly
- Avoid exposing TNS listeners to the internet
- Review access control and firewall rules to minimize external attack surfaces
This incident shows the continued risks from legacy network protocols. Oracle’s TNS listener tool (lsnrctl) dates back nearly 30 years. As a best practice, experts recommend keeping database services off the public internet whenever possible.
Proper patching and secure configuration remain the most effective defenses against vulnerabilities like CVE-2025-30733.
