CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
Percentile
97.3%
A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS) in which the module does not properly decode double URL encoded strings. This vulnerability could allow an intruder to read files outside the web server’s root directory.
NGSSoftware has released Insight Security Research Advisory #NISR20122001 describing two vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). The second of these vulnerabilities, improper URL decoding, is discussed in this document.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module also provides the ability to remotely administer the Database Access Descriptors (DAD) and access help pages. While access to the DADs is restricted by username and password, access to the help pages is not and they can be accessed by any user.
According to RFC 1738 and RFC 2396, certain characters must be encoded in order to be used in URLs, and any character may be encoded. This process is called URL encoding. While parsing a URL, the PL/SQL Apache module only performs one decoding pass, and therefore does not properly decode double URL encoded strings. As a result, a crafted HTTP request for a help page containing double URL encoded characters may be decoded in to a representation of …/, allowing access to files outside the root of the web server.
The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.
An unauthenticated remote intruder could read files outside the root of the web server with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an intruder may be able to read any file on the system that can be displayed in a web browser.
Apply Patch
Apply the appropriate patch referenced in Oracle Security Alert #25.
Disable Vulnerable Service
Disable the PL/SQL service (modplsql or mod_plsql in Apache).
758483
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: March 12, 2002
Affected
Oracle has released Oracle Security Alert #25.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23758483 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
The CERT/CC thanks NGSSoftware and Oracle for information used in this document.
This document was written by Art Manion.
CVE IDs: | CVE-2001-1217 |
---|---|
Severity Metric: | 3.99 Date Public: |
metalink.oracle.com/
otn.oracle.com/deploy/security/pdf/modplsql.pdf
otn.oracle.com/tech/pl_sql/content.html
www.blooberry.com/indexdot/html/topics/urlencoding.htm
www.ietf.org/rfc/rfc1738.txt
www.ietf.org/rfc/rfc2396.txt
www.nextgenss.com/advisories/plsql.txt
www.securityfocus.com/bid/3727
xforce.iss.net/static/7728.php