CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
86.7%
It is possible to read the sensitive configuration files from an Oracle 9i Application Server without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it.
Default installation of the Oracle 9i Application Server does not set appropriate permissions to configuration files that contain sensitive information (see VU#476619). Since these files are not protected by default, any user can access the files directly through a virtual directory and view the contents. When these files have the appropriate permissions set, an HTTP request to access the files results in a “403 Forbidden” response. However, access can be gained by requesting the file using the XSQLServlet. This servlet will bypass any permissions placed on the file and display its content.
An intruder can read files that shouldn’t be accessable, and gain sensitive information about the configuration of the server. This information can be used to compromise the server.
The CERT/CC is currently unaware of a practical solution to this problem.
Apply the appropriate permissions to the configuration files and remove the XSQLServlet, if possible.
977251
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 13, 2002 Updated: March 06, 2002
Affected
See, <http://otn.oracle.com/deploy/security/pdf/ojvm_alert.pdf>
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23977251 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
<http://www.nextgenss.com/papers/hpoas.pdf>
Our thanks to David Litchfield of NGSSoftware, who reported on this vulnerability.
This document was written by Jason Rafail and is based on the report by David Litchfield.
CVE IDs: | CVE-2002-0569 |
---|---|
Severity Metric: | 22.50 Date Public: |