2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.938 High
EPSS
Percentile
99.1%
It is possible to read the “XSQLConfig.xml” and “soapConfig.xml” configuration files from an Oracle 9i Application Server under the default installation without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it.
The XSQL configuration and SOAP configuration files contain sensitive information such as the database server host name, user ID’s and passwords. Since these files are not protected by default, any user can access it directly through a virtual directory and view the contents.
An intruder can gain sensitive information about the configuration of the server. This information can be used to compromise the server.
Apply the appropriate permissions to these files, please see Oracle’s Security Alert on this issue.
Apply the appropriate permissions to the “XSQLConfig.xml” and “soapConfig.xml” configuration files.
476619
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 13, 2002 Updated: February 27, 2002
Affected
Please see Oracle’s Security Alert at <http://otn.oracle.com/deploy/security/pdf/ojvm_alert.pdf>.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23476619 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
<http://www.nextgenss.com/papers/hpoas.pdf>
Our thanks to David Litchfield of NGSSoftware, who reported on this vulnerability.
This document was written by Jason Rafail and is based on the report by David Litchfield.
CVE IDs: | CVE-2002-0568 |
---|---|
Severity Metric: | 42.19 Date Public: |