{"id": "OPENVAS:136141256231010848", "bulletinFamily": "scanner", "title": "Oracle 9iAS Dynamic Monitoring Services", "description": "In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.", "published": "2005-11-03T00:00:00", "modified": "2020-05-08T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "reporter": "Copyright (C) 2002 Matt Moore", "references": [], "cvelist": ["CVE-2002-0563"], "type": "openvas", "lastseen": "2020-05-12T15:08:27", "history": [{"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0563"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.", "edition": 2, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "1b1744f54ffd49c9a4bc2d08374c31b110f9feac4f320d985d36f49caff4c4bc", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b23d7b1533cbc4a335e347d335aee40d", "key": "href"}, {"hash": "4fb7fd6149697e74d091717ea3f1ca84", "key": "modified"}, {"hash": "439e7cb53da9945a2c37480aead19d13", "key": "pluginID"}, {"hash": "bc26ec812993126982a73b15317a9dd5", "key": "cvelist"}, {"hash": "4387ee7f2fea4f823a70351e1107e8b2", "key": "sourceData"}, {"hash": "259134bec0088b8297ee9bdae24a7b22", "key": "description"}, {"hash": "58c499048e4fdc71f70ff4f48f2aef4a", "key": "reporter"}, {"hash": "df034d9b90ece22f6e868d36506db720", "key": "published"}, {"hash": "f339510543c049ec3564d7454008d16b", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "id": "OPENVAS:136141256231010848", "lastseen": "2018-08-30T19:16:39", "modified": "2018-04-06T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "136141256231010848", "published": "2005-11-03T00:00:00", "references": [], "reporter": "This script is Copyright (C) 2002 Matt Moore", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: oracle9i_apache_dms.nasl 9348 2018-04-06 07:01:19Z cfischer $\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_summary = \"In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.\";\n\ntag_solution = \"Edit httpd.conf to restrict access to /dms0.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"$Revision: 9348 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:01:19 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n name = \"Oracle 9iAS Dynamic Monitoring Services\";\n script_name(name);\n \n \n \n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n \n script_copyright(\"This script is Copyright (C) 2002 Matt Moore\");\n family = \"Web application abuses\";\n script_family(family);\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\"); \n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\n\nif(get_port_state(port))\n{ \n req = http_get(item:\"/dms0\", port:port);\t \n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"DMSDUMP version\" >< r)\t\n \tsecurity_message(port);\n\n }\n}\n", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "viewCount": 0}, "differentElements": ["cvss"], "edition": 2, "lastseen": "2018-08-30T19:16:39"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0563"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.", "edition": 1, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "8004bfbfc68833c01a3ddd11d3cadbbb64b00cbdbdac3395ae3076e1e3a78f05", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b23d7b1533cbc4a335e347d335aee40d", "key": "href"}, {"hash": "4fb7fd6149697e74d091717ea3f1ca84", "key": "modified"}, {"hash": "439e7cb53da9945a2c37480aead19d13", "key": "pluginID"}, {"hash": "bc26ec812993126982a73b15317a9dd5", "key": "cvelist"}, {"hash": "4387ee7f2fea4f823a70351e1107e8b2", "key": "sourceData"}, {"hash": "259134bec0088b8297ee9bdae24a7b22", "key": "description"}, {"hash": "58c499048e4fdc71f70ff4f48f2aef4a", "key": "reporter"}, {"hash": "df034d9b90ece22f6e868d36506db720", "key": "published"}, {"hash": "f339510543c049ec3564d7454008d16b", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "id": "OPENVAS:136141256231010848", "lastseen": "2018-04-06T11:15:57", "modified": "2018-04-06T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "136141256231010848", "published": "2005-11-03T00:00:00", "references": [], "reporter": "This script is Copyright (C) 2002 Matt Moore", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: oracle9i_apache_dms.nasl 9348 2018-04-06 07:01:19Z cfischer $\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_summary = \"In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.\";\n\ntag_solution = \"Edit httpd.conf to restrict access to /dms0.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"$Revision: 9348 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:01:19 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n name = \"Oracle 9iAS Dynamic Monitoring Services\";\n script_name(name);\n \n \n \n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n \n script_copyright(\"This script is Copyright (C) 2002 Matt Moore\");\n family = \"Web application abuses\";\n script_family(family);\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\"); \n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\n\nif(get_port_state(port))\n{ \n req = http_get(item:\"/dms0\", port:port);\t \n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"DMSDUMP version\" >< r)\t\n \tsecurity_message(port);\n\n }\n}\n", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "viewCount": 0}, "differentElements": ["cvss"], "edition": 1, "lastseen": "2018-04-06T11:15:57"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0563"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.", "edition": 7, "enchantments": {"dependencies": {"modified": "2020-05-11T19:06:09", "references": [{"idList": ["ORACLE_APPLICATION_SERVER_PCI.NASL", "ORACLE9I_APACHE_DMS.NASL", "ORACLE9I_JAVA_PROCESS_MANAGER.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:136141256231010851", "OPENVAS:10848", "OPENVAS:10851"], "type": "openvas"}, {"idList": ["OSVDB:705"], "type": "osvdb"}, {"idList": ["CVE-2002-0563"], "type": "cve"}, {"idList": ["VU:168795"], "type": "cert"}], "rev": 2}, "score": {"modified": "2020-05-11T19:06:09", "rev": 2, "value": 6.5, "vector": "NONE"}}, "hash": "2be87433d414c869198009df68a80232bed946f1f33004ea7f80c12e1e86614f", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b23d7b1533cbc4a335e347d335aee40d", "key": "href"}, {"hash": "a76a76a71c4178d77ec0c18e9261a6ae", "key": "reporter"}, {"hash": "439e7cb53da9945a2c37480aead19d13", "key": "pluginID"}, {"hash": "bc26ec812993126982a73b15317a9dd5", "key": "cvelist"}, {"hash": "8bd68b7d7647e4b1ccfd30fc2eaf4257", "key": "modified"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "aaf1695404bd10c63ed3df5a4b05a271", "key": "sourceData"}, {"hash": "df034d9b90ece22f6e868d36506db720", "key": "published"}, {"hash": "f339510543c049ec3564d7454008d16b", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "944cc1c56182eeaeb70b119ffa7b6dbe", "key": "description"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "id": "OPENVAS:136141256231010848", "lastseen": "2020-05-11T19:06:09", "modified": "2020-05-11T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "136141256231010848", "published": "2005-11-03T00:00:00", "references": [], "reporter": "Copyright (C) 2002 Matt Moore", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nCPE = \"cpe:/a:oracle:http_server\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"2020-05-08T08:34:44+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-11 12:46:33 +0000 (Mon, 11 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n script_name(\"Oracle 9iAS Dynamic Monitoring Services\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2002 Matt Moore\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_oracle_app_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"oracle/http_server/detected\");\n\n script_tag(name:\"solution\", value:\"Edit httpd.conf to restrict access to /dms0.\");\n\n script_tag(name:\"summary\", value:\"In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.\");\n\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n script_tag(name:\"solution_type\", value:\"Mitigation\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!port = get_app_port(cpe:CPE))\n exit(0);\n\nif(!get_app_location(cpe:CPE, port:port))\n exit(0);\n\nurl = \"/dms0\";\nreq = http_get(item:url, port:port);\nres = http_send_recv(port:port, data:req);\nif(!res)\n exit(0);\n\nif(\"DMSDUMP version\" >< res) {\n report = http_report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);\n", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "viewCount": 2}, "differentElements": ["modified", "sourceData"], "edition": 7, "lastseen": "2020-05-11T19:06:09"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0563"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.", "edition": 6, "enchantments": {"dependencies": {"modified": "2020-02-04T16:37:35", "references": [{"idList": ["ORACLE_APPLICATION_SERVER_PCI.NASL", "ORACLE9I_APACHE_DMS.NASL", "ORACLE9I_JAVA_PROCESS_MANAGER.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:136141256231010851", "OPENVAS:10848", "OPENVAS:10851"], "type": "openvas"}, {"idList": ["OSVDB:705"], "type": "osvdb"}, {"idList": ["CVE-2002-0563"], "type": "cve"}, {"idList": ["VU:168795"], "type": "cert"}], "rev": 2}, "score": {"modified": "2020-02-04T16:37:35", "rev": 2, "value": 6.5, "vector": "NONE"}}, "hash": "848b361e1f1b59e793caf1eed003e6cb609a7283c1a0e43a5a9835f67fd50621", "hashmap": [{"hash": "e26356a03eac2490dfbe0c1bd5668c39", "key": "sourceData"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b23d7b1533cbc4a335e347d335aee40d", "key": "href"}, {"hash": "a76a76a71c4178d77ec0c18e9261a6ae", "key": "reporter"}, {"hash": "439e7cb53da9945a2c37480aead19d13", "key": "pluginID"}, {"hash": "bc26ec812993126982a73b15317a9dd5", "key": "cvelist"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "df034d9b90ece22f6e868d36506db720", "key": "published"}, {"hash": "f339510543c049ec3564d7454008d16b", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "944cc1c56182eeaeb70b119ffa7b6dbe", "key": "description"}, {"hash": "2fe12e40a71b7ab20a10a468397aabed", "key": "modified"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "id": "OPENVAS:136141256231010848", "lastseen": "2020-02-04T16:37:35", "modified": "2020-02-03T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "136141256231010848", "published": "2005-11-03T00:00:00", "references": [], "reporter": "Copyright (C) 2002 Matt Moore", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nCPE = \"cpe:/a:oracle:http_server\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"2020-02-03T15:12:40+0000\");\n script_tag(name:\"last_modification\", value:\"2020-02-03 15:12:40 +0000 (Mon, 03 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n script_name(\"Oracle 9iAS Dynamic Monitoring Services\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2002 Matt Moore\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_oracle_app_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"oracle/http_server/detected\");\n\n script_tag(name:\"solution\", value:\"Edit httpd.conf to restrict access to /dms0.\");\n\n script_tag(name:\"summary\", value:\"In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.\");\n\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n script_tag(name:\"solution_type\", value:\"Mitigation\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!port = get_app_port(cpe:CPE))\n exit(0);\n\nif(!get_app_location(cpe:CPE, port:port))\n exit(0);\n\nurl = \"/dms0\";\nreq = http_get(item:url, port:port);\nres = http_send_recv(port:port, data:req);\nif(!res)\n exit(0);\n\nif(\"DMSDUMP version\" >< res) {\n report = report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);\n", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "viewCount": 2}, "differentElements": ["modified", "sourceData"], "edition": 6, "lastseen": "2020-02-04T16:37:35"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0563"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.", "edition": 5, "enchantments": {"dependencies": {"modified": "2019-05-29T18:32:01", "references": [{"idList": ["ORACLE_APPLICATION_SERVER_PCI.NASL", "ORACLE9I_APACHE_DMS.NASL", "ORACLE9I_JAVA_PROCESS_MANAGER.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:136141256231010851", "OPENVAS:10848", "OPENVAS:10851"], "type": "openvas"}, {"idList": ["OSVDB:705"], "type": "osvdb"}, {"idList": ["CVE-2002-0563"], "type": "cve"}, {"idList": ["VU:168795"], "type": "cert"}]}, "score": {"modified": "2019-05-29T18:32:01", "value": 6.4, "vector": "NONE"}}, "hash": "6eb610fcbd90a7149786427161b631cec93a94241ea28ab6ba7407a61ef7ccab", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b70aa8888b78699028005857bbf97d5e", "key": "modified"}, {"hash": "b23d7b1533cbc4a335e347d335aee40d", "key": "href"}, {"hash": "db2457d9b9b1e96322f260536d8ec31a", "key": "sourceData"}, {"hash": "439e7cb53da9945a2c37480aead19d13", "key": "pluginID"}, {"hash": "bc26ec812993126982a73b15317a9dd5", "key": "cvelist"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "58c499048e4fdc71f70ff4f48f2aef4a", "key": "reporter"}, {"hash": "df034d9b90ece22f6e868d36506db720", "key": "published"}, {"hash": "f339510543c049ec3564d7454008d16b", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "944cc1c56182eeaeb70b119ffa7b6dbe", "key": "description"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010848", "id": "OPENVAS:136141256231010848", "lastseen": "2019-05-29T18:32:01", "modified": "2019-04-24T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "136141256231010848", "published": "2005-11-03T00:00:00", "references": [], "reporter": "This script is Copyright (C) 2002 Matt Moore", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"2019-04-24T07:26:10+0000\");\n script_tag(name:\"last_modification\", value:\"2019-04-24 07:26:10 +0000 (Wed, 24 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n script_name(\"Oracle 9iAS Dynamic Monitoring Services\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"This script is Copyright (C) 2002 Matt Moore\");\n script_family(\"Web application abuses\");\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"www/OracleApache\");\n\n script_tag(name:\"solution\", value:\"Edit httpd.conf to restrict access to /dms0.\");\n\n script_tag(name:\"summary\", value:\"In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.\");\n\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n script_tag(name:\"solution_type\", value:\"Mitigation\");\n\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\n\nurl = \"/dms0\";\nreq = http_get(item:url, port:port);\nres = http_send_recv(port:port, data:req);\nif(!res)\n exit(0);\n\nif(\"DMSDUMP version\" >< res) {\n report = report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "viewCount": 2}, "differentElements": ["reporter", "modified", "sourceData"], "edition": 5, "lastseen": "2019-05-29T18:32:01"}], "edition": 8, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "bc26ec812993126982a73b15317a9dd5"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "description", "hash": "944cc1c56182eeaeb70b119ffa7b6dbe"}, {"key": "href", "hash": "b23d7b1533cbc4a335e347d335aee40d"}, {"key": "modified", "hash": "86ec5c88edfbd4bfbe98624a4a03106b"}, {"key": "naslFamily", "hash": "55199d25018fbdb9b50e6b64d444c3a4"}, {"key": "pluginID", "hash": "439e7cb53da9945a2c37480aead19d13"}, {"key": "published", "hash": "df034d9b90ece22f6e868d36506db720"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a76a76a71c4178d77ec0c18e9261a6ae"}, {"key": "sourceData", "hash": "bdbe4f22502f8797c4318cf824b3b4e5"}, {"key": "title", "hash": "f339510543c049ec3564d7454008d16b"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "hash": "341d95e9411c78ca9514797dd59014bd7fe6205d4e08eb758d1c08d24bdf2d88", "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2002-0563"]}, {"type": "openvas", "idList": ["OPENVAS:10848", "OPENVAS:10851", "OPENVAS:136141256231010851"]}, {"type": "osvdb", "idList": ["OSVDB:705"]}, {"type": "nessus", "idList": ["ORACLE9I_JAVA_PROCESS_MANAGER.NASL", "ORACLE_APPLICATION_SERVER_PCI.NASL", "ORACLE9I_APACHE_DMS.NASL"]}, {"type": "cert", "idList": ["VU:168795"]}], "modified": "2020-05-12T15:08:27", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2020-05-12T15:08:27", "rev": 2}, "vulnersScore": 6.6}, "objectVersion": "1.3", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nCPE = \"cpe:/a:oracle:http_server\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10848\");\n script_version(\"2020-05-08T08:34:44+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-08 08:34:44 +0000 (Fri, 08 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n script_name(\"Oracle 9iAS Dynamic Monitoring Services\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2002 Matt Moore\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_oracle_app_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"oracle/http_server/detected\");\n\n script_tag(name:\"solution\", value:\"Edit httpd.conf to restrict access to /dms0.\");\n\n script_tag(name:\"summary\", value:\"In a default installation of Oracle 9iAS, it is possible to access the\n Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.\");\n\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n script_tag(name:\"solution_type\", value:\"Mitigation\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!port = get_app_port(cpe:CPE))\n exit(0);\n\nif(!get_app_location(cpe:CPE, port:port))\n exit(0);\n\nurl = \"/dms0\";\nreq = http_get(item:url, port:port);\nres = http_send_recv(port:port, data:req);\nif(!res)\n exit(0);\n\nif(\"DMSDUMP version\" >< res) {\n report = http_report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);\n", "naslFamily": "Web application abuses", "pluginID": "136141256231010848", "scheme": null}

{"cve": [{"lastseen": "2019-05-29T18:07:39", "bulletinFamily": "NVD", "description": "The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.", "modified": "2017-07-11T01:29:00", "id": "CVE-2002-0563", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0563", "published": "2002-07-03T04:00:00", "title": "CVE-2002-0563", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "nessus": [{"lastseen": "2020-05-01T01:57:33", "bulletinFamily": "scanner", "description": "In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.", "modified": "2020-05-02T00:00:00", "id": "ORACLE9I_APACHE_DMS.NASL", "href": "https://www.tenable.com/plugins/nessus/10848", "published": "2002-02-07T00:00:00", "title": "Oracle 9iAS DMS / JPM Pages Anonymous Access", "type": "nessus", "sourceData": "#\n# This script was written by Matt Moore <matt.moore@westpoint.ltd.uk>\n#\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# See the Nessus Scripts License for details\n#\n\n# Changes by Tenable:\n# - Revised plugin title (6/9/09)\n\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(10848);\n script_version(\"1.23\");\n\n script_cve_id(\"CVE-2002-0563\");\n script_bugtraq_id(4293);\n\n script_name(english:\"Oracle 9iAS DMS / JPM Pages Anonymous Access\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"Sensitive resources can be accessed.\" );\n script_set_attribute(attribute:\"description\", value:\n\"In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Edit httpd.conf to restrict access to /dms0.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(287);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2002/02/07\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2002/01/10\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2002/02/06\");\n script_cvs_date(\"Date: 2018/08/22 16:49:13\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:application_server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:application_server_web_cache\");\n script_end_attributes();\n\n \n script_summary(english:\"Tests for presence of Oracle9iAS Dynamic Monitoring Services\");\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Matt Moore\");\n script_family(english:\"Databases\");\n script_dependencie(\"find_service1.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\"); \n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\ninclude(\"global_settings.inc\");\n\nport = get_http_port(default:80);\n\nif(get_port_state(port))\n{ \n req = http_get(item:\"/dms0\", port:port);\t \n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"DMSDUMP version\" >< r)\t\n \tsecurity_warning(port);\n\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-05-01T01:57:33", "bulletinFamily": "scanner", "description": "The remote host is an Oracle 9iAS server. By default, accessing\nthe location /oprocmgr-status via HTTP lets an attacker obtain\nthe list of processes running on the remote host, and even to\nto start or stop them.", "modified": "2020-05-02T00:00:00", "id": "ORACLE9I_JAVA_PROCESS_MANAGER.NASL", "href": "https://www.tenable.com/plugins/nessus/10851", "published": "2002-02-07T00:00:00", "title": "Oracle 9iAS Java Process Manager /oprocmgr-status Anonymous Process Manipulation", "type": "nessus", "sourceData": "#\n# This script was written by Matt Moore <matt.moore@westpoint.ltd.uk>\n#\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# See the Nessus Scripts License for details\n#\n\n# Changes by Tenable:\n# - Revised plugin title (6/10/09)\n\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(10851);\n script_version(\"1.25\");\n\n script_cve_id(\"CVE-2002-0563\");\n script_bugtraq_id(4293);\n\n script_name(english:\"Oracle 9iAS Java Process Manager /oprocmgr-status Anonymous Process Manipulation\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"It is possible to obtain the list of Java processes running on the\nremote host anonymously, as well as to start and stop them.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is an Oracle 9iAS server. By default, accessing\nthe location /oprocmgr-status via HTTP lets an attacker obtain\nthe list of processes running on the remote host, and even to\nto start or stop them.\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Restrict access to /oprocmgr-status in httpd.conf\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(287);\n # http://web.archive.org/web/20030407050036/http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?80fe4531\");\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2002/02/07\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2002/02/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2002/02/06\");\n script_cvs_date(\"Date: 2018/07/16 14:09:13\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:application_server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:application_server_web_cache\");\n script_end_attributes();\n\n \n script_summary(english:\"Tests for Oracle9iAS Java Process Manager\");\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Matt Moore\");\n script_family(english:\"Databases\");\n script_dependencie(\"find_service1.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\");\n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\ninclude(\"global_settings.inc\");\n\nport = get_http_port(default:80);\n\n\nif(get_port_state(port))\n{ \n# Make a request for /oprocmgr-status\n\n req = http_get(item:\"/oprocmgr-status\", port:port);\n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"Module Name\" >< r)\t\n \tsecurity_warning(port);\n\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-05-01T01:57:35", "bulletinFamily": "scanner", "description": "The remote host is running Oracle Application Server. It was not possible\nto determine its version, so the version of Oracle Application Server\ninstalled on the remote host could potentially be affected by multiple\nvulnerabilities :\n\n - CVE-2000-0169: Remote command execution in the web\n listener component.\n\n - CVE-2000-1235: Information disclosure in the port\n listener component and modplsql.\n\n - CVE-2000-1236: SQL injection in mod_sql.\n\n - CVE-2001-0326: Information disclosure in the Java\n Virtual Machine.\n\n - CVE-2001-0419: Buffer overflow in ndwfn4.so.\n\n - CVE-2001-0591: Directory traversal.\n\n - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.\n\n - CVE-2001-1217: Directory traversal vulnerability in the\n PL/SQL Apache module.\n\n - CVE-2001-1371: Improper access control in the SOAP\n service.\n\n - CVE-2001-1372: Information disclosure.\n\n - CVE-2002-0386: Denial of service through the\n administration module for Oracle Web Cache.\n\n - CVE-2002-0559: Buffer overflows in the PL/SQL module.\n\n - CVE-2002-0560: Information disclosure in the PL/SQL\n module.\n\n - CVE-2002-0561: Authentication bypass in the PL/SQL\n Gateway web administration interface.\n\n - CVE-2002-0562: Information disclosure through\n globals.jsa.\n\n - CVE-2002-0563: Improper access control on several\n services.\n\n - CVE-2002-0564: Authentication bypass in the PL/SQL\n module.\n\n - CVE-2002-0565: Information disclosure through JSP files\n in the _pages directory.\n\n - CVE-2002-0566: Denial of service in the PL/SQL module.\n\n - CVE-2002-0568: Improper access control on XSQLConfig.xml\n and soapConfig.xml.\n\n - CVE-2002-0569: Authentication bypass through\n XSQLServlet.\n\n - CVE-2002-0655: Denial of service in OpenSSL.\n\n - CVE-2002-0656: Buffer overflows in OpenSSL.\n\n - CVE-2002-0659: Denial of service in OpenSSL.\n\n - CVE-2002-0840: Cross-site scripting in the default error\n page of Apache.\n\n - CVE-2002-0842: Format string vulnerability in mod_dav.\n\n - CVE-2002-0843: Buffer overflows in ApacheBench.\n\n - CVE-2002-0947: Buffer overflow in rwcgi60.\n\n - CVE-2002-1089: Information disclosure in rwcgi60.\n\n - CVE-2002-1630: Improper access control on sendmail.jsp.\n\n - CVE-2002-1631: SQL injection in query.xsql.\n\n - CVE-2002-1632: Information disclosure through several\n JSP pages.\n\n - CVE-2002-1635: Information disclosure in Apache.\n\n - CVE-2002-1636: Cross-site scripting in the htp PL/SQL\n package.\n\n - CVE-2002-1637: Default credentials in multiple\n components.\n\n - CVE-2002-1858: Information disclosure through the\n WEB-INF directory.\n\n - CVE-2002-2153: Format string vulnerability in the\n administrative pages of the PL/SQL module.\n\n - CVE-2002-2345: Credential leakage in the web cache\n administrator interface.\n\n - CVE-2002-2347: Cross-site scripting in several JSP\n pages.\n\n - CVE-2004-1362: Authentication bypass in the PL/SQL\n module.\n\n - CVE-2004-1363: Buffer overflow in extproc.\n\n - CVE-2004-1364: Directory traversal in extproc.\n\n - CVE-2004-1365: Command execution in extproc.\n\n - CVE-2004-1366: Improper access control on\n emoms.properties.\n\n - CVE-2004-1367: Credential leakage in Database Server.\n\n - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.\n\n - CVE-2004-1369: Denial of service in TNS Listener.\n\n - CVE-2004-1370: Multiple SQL injection vulnerabilities in\n PL/SQL.\n\n - CVE-2004-1371: Stack-based buffer overflow.\n\n - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.\n\n - CVE-2004-1774: Buffer overflow in the MD2 package.\n\n - CVE-2004-1877: Phishing vulnerability in Single Sign-On\n component.\n\n - CVE-2004-2134: Weak cryptography for passwords in the\n toplink mapping workBench.\n\n - CVE-2004-2244: Denial of service in the XML parser.\n\n - CVE-2005-1383: Authentication bypass in HTTP Server.\n\n - CVE-2005-1495: Detection bypass.\n\n - CVE-2005-1496: Privilege escalation in the\n DBMS_Scheduler.\n\n - CVE-2005-2093: Web cache poisoning.\n\n - CVE-2005-3204: Cross-site scripting.\n\n - CVE-2005-3445: Multiple unspecified vulnerabilities in\n HTTP Server.\n\n - CVE-2005-3446: Unspecified vulnerability in Internet\n Directory.\n\n - CVE-2005-3447: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2005-3448: Unspecified vulnerability in the OC4J\n module.\n\n - CVE-2005-3449: Multiple unspecified vulnerabilities in\n multiple components.\n\n - CVE-2005-3450: Unspecified vulnerability in HTTP Server.\n\n - CVE-2005-3451: Unspecified vulnerability in\n SQL*ReportWriter.\n\n - CVE-2005-3452: Unspecified vulnerability in Web Cache.\n\n - CVE-2005-3453: Multiple unspecified vulnerabilities in\n Web Cache.\n\n - CVE-2006-0273: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2006-0274: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2006-0275: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2006-0282: Unspecified vulnerability.\n\n - CVE-2006-0283: Unspecified vulnerability.\n\n - CVE-2006-0284: Multiple unspecified vulnerabilities.\n\n - CVE-2006-0285: Unspecified vulnerability in the Java Net\n component.\n\n - CVE-2006-0286: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-0287: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-0288: Multiple unspecified vulnerabilities in\n the Oracle Reports Developer component.\n\n - CVE-2006-0289: Multiple unspecified vulnerabilities.\n\n - CVE-2006-0290: Unspecified vulnerability in the Oracle\n Workflow Cartridge component.\n\n - CVE-2006-0291: Multiple unspecified vulnerabilities in\n the Oracle Workflow Cartridge component.\n\n - CVE-2006-0435: Unspecified vulnerability in Oracle\n PL/SQL.\n\n - CVE-2006-0552: Unspecified vulnerability in the Net\n Listener component.\n\n - CVE-2006-0586: Multiple SQL injection vulnerabilities.\n\n - CVE-2006-1884: Unspecified vulnerability in the Oracle\n Thesaurus Management System component.\n\n - CVE-2006-3706: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3707: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3708: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3709: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3710: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3711: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3712: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3713: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3714: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5353: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5354: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5355: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2006-5356: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5357: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5358: Unspecified vulnerability in the Oracle\n Forms component.\n\n - CVE-2006-5359: Multiple unspecified vulnerabilities in\n Oracle Reports Developer component.\n\n - CVE-2006-5360: Unspecified vulnerability in Oracle Forms\n component.\n\n - CVE-2006-5361: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5362: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5363: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2006-5364: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5365: Unspecified vulnerability in Oracle\n Forms.\n\n - CVE-2006-5366: Multiple unspecified vulnerabilities.\n\n - CVE-2007-0222: Directory traversal vulnerability in\n EmChartBean.\n\n - CVE-2007-0275: Cross-site scripting vulnerability in\n Oracle Reports Web Cartridge (RWCGI60).\n\n - CVE-2007-0280: Buffer overflow in Oracle Notification\n Service.\n\n - CVE-2007-0281: Multiple unspecified vulnerabilities in\n HTTP Server.\n\n - CVE-2007-0282: Unspecified vulnerability in OPMN02.\n\n - CVE-2007-0283: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0284: Multiple unspecified vulnerabilities in\n Oracle Containers for J2EE.\n\n - CVE-2007-0285: Unspecified vulnerability in Oracle\n Reports Developer.\n\n - CVE-2007-0286: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0287: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0288: Unspecified vulnerability in Oracle\n Internet Directory.\n\n - CVE-2007-0289: Multiple unspecified vulnerabilities in\n Oracle Containers for J2EE.\n\n - CVE-2007-1359: Improper access control in mod_security.\n\n - CVE-2007-1609: Cross-site scripting vulnerability in\n servlet/Spy in Dynamic Monitoring Services (DMS).\n\n - CVE-2007-2119: Cross-site scripting vulnerability in the\n Administration Front End for Oracle Enterprise (Ultra)\n Search.\n\n - CVE-2007-2120: Denial of service in the Oracle\n Discoverer servlet.\n\n - CVE-2007-2121: Unspecified vulnerability in the COREid\n Access component.\n\n - CVE-2007-2122: Unspecified vulnerability in the Wireless\n component.\n\n - CVE-2007-2123: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2007-2124: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2007-2130: Unspecified vulnerability in Workflow\n Cartridge.\n\n - CVE-2007-3553: Cross-site scripting vulnerability in\n Rapid Install Web Server.\n\n - CVE-2007-3854: Multiple unspecified vulnerabilities in\n the Advanced Queuing component and the Spatial\n component.\n\n - CVE-2007-3859: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-3861: Unspecified vulnerability in Oracle\n Jdeveloper.\n\n - CVE-2007-3862: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-3863: Unspecified vulnerability in Oracle\n JDeveloper.\n\n - CVE-2007-5516: Unspecified vulnerability in the Oracle\n Process Mgmt & Notification component.\n\n - CVE-2007-5517: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5518: Unspecified vulnerability in HTTP Server.\n\n - CVE-2007-5519: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5520: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-5521: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-5522: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5523: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-5524: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-5525: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-5526: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5531: Unspecified vulnerability in Oracle Help\n for Web.\n\n - CVE-2008-0340: Multiple unspecified vulnerabilities in\n the Advanced Queuing component and Spatial component.\n\n - CVE-2008-0343: Unspecified vulnerability in the Oracle\n Spatial component.\n\n - CVE-2008-0344: Unspecified vulnerability in the Oracle\n Spatial component.\n\n - CVE-2008-0345: Unspecified vulnerability in the Core\n RDBMS component.\n\n - CVE-2008-0346: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2008-0347: Unspecified vulnerability in the Oracle\n Ultra Search component.\n\n - CVE-2008-0348: Multiple unspecified vulnerabilities in\n the PeopleTools component.\n\n - CVE-2008-0349: Unspecified vulnerability in the\n PeopleTools component.\n\n - CVE-2008-1812: Unspecified vulnerability in the Oracle\n Enterprise Manager component.\n\n - CVE-2008-1814: Unspecified vulnerability in the Oracle\n Secure Enterprise Search or Ultrasearch component.\n\n - CVE-2008-1823: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2008-1824: Unspecified vulnerability in the Oracle\n Dynamic Monitoring Service component.\n\n - CVE-2008-1825: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2583: Unspecified vulnerability in the sample\n Discussion Forum Portlet for the Oracle Portal\n component.\n\n - CVE-2008-2588: Unspecified vulnerability in the Oracle\n JDeveloper component.\n\n - CVE-2008-2589: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2593: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2594: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2595: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2008-2609: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2612: Unspecified vulnerability in the Hyperion\n BI Plus component.\n\n - CVE-2008-2614: Unspecified vulnerability in HTTP Server.\n\n - CVE-2008-2619: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2008-2623: Unspecified vulnerability in the Oracle\n JDeveloper component.\n\n - CVE-2008-3975: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-3977: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-3986: Unspecified vulnerability in the Oracle\n Discoverer Administrator component.\n\n - CVE-2008-3987: Unspecified vulnerability in the Oracle\n Discoverer Desktop component.\n\n - CVE-2008-4014: Unspecified vulnerability in the Oracle\n BPEL Process Manager component.\n\n - CVE-2008-4017: Unspecified vulnerability in the OC4J\n component.\n\n - CVE-2008-5438: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-7233: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2009-0217: Signature spoofing vulnerability in\n multiple components.\n\n - CVE-2009-0989: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-0990: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-0994: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-1008: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1009: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1010: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1011: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1017: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-1976: Unspecified vulnerability in HTTP Server.\n\n - CVE-2009-1990: Unspecified vulnerability in the Business\n Intelligence Enterprise Edition component.\n\n - CVE-2009-1999: Unspecified vulnerability in the Business\n Intelligence Enterprise Edition component.\n\n - CVE-2009-3407: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2009-3412: Unspecified vulnerability in the Unzip\n component.\n\n - CVE-2010-0066: Unspecified vulnerability in the Access\n Manager Identity Server component.\n\n - CVE-2010-0067: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2010-0070: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2011-0789: Unspecified vulnerability in HTTP Server.\n\n - CVE-2011-0795: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2011-0884: Unspecified vulnerability in the Oracle\n BPEL Process Manager component.\n\n - CVE-2011-2237: Unspecified vulnerability in the Oracle\n Web Services Manager component.\n\n - CVE-2011-2314: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2011-3523: Unspecified vulnerability in the Oracle\n Web Services Manager component.", "modified": "2020-05-02T00:00:00", "id": "ORACLE_APPLICATION_SERVER_PCI.NASL", "href": "https://www.tenable.com/plugins/nessus/57619", "published": "2012-01-24T00:00:00", "title": "Oracle Application Server Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(57619);\n script_version(\"1.23\");\n script_cvs_date(\"Date: 2019/04/05 15:04:42\");\n\n script_cve_id(\n \"CVE-2000-0169\",\n \"CVE-2000-1235\",\n \"CVE-2000-1236\",\n \"CVE-2001-0326\",\n \"CVE-2001-0419\",\n \"CVE-2001-0591\",\n \"CVE-2001-1216\",\n \"CVE-2001-1217\",\n \"CVE-2001-1371\",\n \"CVE-2001-1372\",\n \"CVE-2002-0386\",\n \"CVE-2002-0559\",\n \"CVE-2002-0560\",\n \"CVE-2002-0561\",\n \"CVE-2002-0562\",\n \"CVE-2002-0563\",\n \"CVE-2002-0564\",\n \"CVE-2002-0565\",\n \"CVE-2002-0566\",\n \"CVE-2002-0568\",\n \"CVE-2002-0569\",\n \"CVE-2002-0655\",\n \"CVE-2002-0656\",\n \"CVE-2002-0659\",\n \"CVE-2002-0840\",\n \"CVE-2002-0842\",\n \"CVE-2002-0843\",\n \"CVE-2002-0947\",\n \"CVE-2002-1089\",\n \"CVE-2002-1630\",\n \"CVE-2002-1631\",\n \"CVE-2002-1632\",\n \"CVE-2002-1635\",\n \"CVE-2002-1636\",\n \"CVE-2002-1637\",\n \"CVE-2002-1858\",\n \"CVE-2002-2153\",\n \"CVE-2002-2345\",\n \"CVE-2002-2347\",\n \"CVE-2004-1362\",\n \"CVE-2004-1363\",\n \"CVE-2004-1364\",\n \"CVE-2004-1365\",\n \"CVE-2004-1366\",\n \"CVE-2004-1367\",\n \"CVE-2004-1368\",\n \"CVE-2004-1369\",\n \"CVE-2004-1370\",\n \"CVE-2004-1371\",\n \"CVE-2004-1707\",\n \"CVE-2004-1774\",\n \"CVE-2004-1877\",\n \"CVE-2004-2134\",\n \"CVE-2004-2244\",\n \"CVE-2005-1383\",\n \"CVE-2005-1495\",\n \"CVE-2005-1496\",\n \"CVE-2005-2093\",\n \"CVE-2005-3204\",\n \"CVE-2005-3445\",\n \"CVE-2005-3446\",\n \"CVE-2005-3447\",\n \"CVE-2005-3448\",\n \"CVE-2005-3449\",\n \"CVE-2005-3450\",\n \"CVE-2005-3451\",\n \"CVE-2005-3452\",\n \"CVE-2005-3453\",\n \"CVE-2006-0273\",\n \"CVE-2006-0274\",\n \"CVE-2006-0275\",\n \"CVE-2006-0282\",\n \"CVE-2006-0283\",\n \"CVE-2006-0284\",\n \"CVE-2006-0285\",\n \"CVE-2006-0286\",\n \"CVE-2006-0287\",\n \"CVE-2006-0288\",\n \"CVE-2006-0289\",\n \"CVE-2006-0290\",\n \"CVE-2006-0291\",\n \"CVE-2006-0435\",\n \"CVE-2006-0552\",\n \"CVE-2006-0586\",\n \"CVE-2006-1884\",\n \"CVE-2006-3706\",\n \"CVE-2006-3707\",\n \"CVE-2006-3708\",\n \"CVE-2006-3709\",\n \"CVE-2006-3710\",\n \"CVE-2006-3711\",\n \"CVE-2006-3712\",\n \"CVE-2006-3713\",\n \"CVE-2006-3714\",\n \"CVE-2006-5353\",\n \"CVE-2006-5354\",\n \"CVE-2006-5355\",\n \"CVE-2006-5356\",\n \"CVE-2006-5357\",\n \"CVE-2006-5358\",\n \"CVE-2006-5359\",\n \"CVE-2006-5360\",\n \"CVE-2006-5361\",\n \"CVE-2006-5362\",\n \"CVE-2006-5363\",\n \"CVE-2006-5364\",\n \"CVE-2006-5365\",\n \"CVE-2006-5366\",\n \"CVE-2007-0222\",\n \"CVE-2007-0275\",\n \"CVE-2007-0280\",\n \"CVE-2007-0281\",\n \"CVE-2007-0282\",\n \"CVE-2007-0283\",\n \"CVE-2007-0284\",\n \"CVE-2007-0285\",\n \"CVE-2007-0286\",\n \"CVE-2007-0287\",\n \"CVE-2007-0288\",\n \"CVE-2007-0289\",\n \"CVE-2007-1359\",\n \"CVE-2007-1609\",\n \"CVE-2007-2119\",\n \"CVE-2007-2120\",\n \"CVE-2007-2121\",\n \"CVE-2007-2122\",\n \"CVE-2007-2123\",\n \"CVE-2007-2124\",\n \"CVE-2007-2130\",\n \"CVE-2007-3553\",\n \"CVE-2007-3854\",\n \"CVE-2007-3859\",\n \"CVE-2007-3861\",\n \"CVE-2007-3862\",\n \"CVE-2007-3863\",\n \"CVE-2007-5516\",\n \"CVE-2007-5517\",\n \"CVE-2007-5518\",\n \"CVE-2007-5519\",\n \"CVE-2007-5520\",\n \"CVE-2007-5521\",\n \"CVE-2007-5522\",\n \"CVE-2007-5523\",\n \"CVE-2007-5524\",\n \"CVE-2007-5525\",\n \"CVE-2007-5526\",\n \"CVE-2007-5531\",\n \"CVE-2008-0340\",\n \"CVE-2008-0343\",\n \"CVE-2008-0344\",\n \"CVE-2008-0345\",\n \"CVE-2008-0346\",\n \"CVE-2008-0347\",\n \"CVE-2008-0348\",\n \"CVE-2008-0349\",\n \"CVE-2008-1812\",\n \"CVE-2008-1814\",\n \"CVE-2008-1823\",\n \"CVE-2008-1824\",\n \"CVE-2008-1825\",\n \"CVE-2008-2583\",\n \"CVE-2008-2588\",\n \"CVE-2008-2589\",\n \"CVE-2008-2593\",\n \"CVE-2008-2594\",\n \"CVE-2008-2595\",\n \"CVE-2008-2609\",\n \"CVE-2008-2612\",\n \"CVE-2008-2614\",\n \"CVE-2008-2619\",\n \"CVE-2008-2623\",\n \"CVE-2008-3975\",\n \"CVE-2008-3977\",\n \"CVE-2008-3986\",\n \"CVE-2008-3987\",\n \"CVE-2008-4014\",\n \"CVE-2008-4017\",\n \"CVE-2008-5438\",\n \"CVE-2008-7233\",\n \"CVE-2009-0217\",\n \"CVE-2009-0989\",\n \"CVE-2009-0990\",\n \"CVE-2009-0994\",\n \"CVE-2009-1008\",\n \"CVE-2009-1009\",\n \"CVE-2009-1010\",\n \"CVE-2009-1011\",\n \"CVE-2009-1017\",\n \"CVE-2009-1976\",\n \"CVE-2009-1990\",\n \"CVE-2009-1999\",\n \"CVE-2009-3407\",\n \"CVE-2009-3412\",\n \"CVE-2010-0066\",\n \"CVE-2010-0067\",\n \"CVE-2010-0070\",\n \"CVE-2011-0789\",\n \"CVE-2011-0795\",\n \"CVE-2011-0884\",\n \"CVE-2011-2237\",\n \"CVE-2011-2314\",\n \"CVE-2011-3523\"\n );\n\n script_bugtraq_id(\n 1053,\n 2150,\n 2286,\n 2569,\n 3341,\n 3726,\n 3727,\n 4032,\n 4034,\n 4037,\n 4289,\n 4290,\n 4292,\n 4293,\n 4294,\n 4298,\n 4844,\n 4848,\n 5119,\n 5262,\n 5362,\n 5363,\n 5364,\n 5366,\n 5452,\n 5847,\n 5887,\n 5902,\n 5995,\n 5996,\n 6556,\n 6846,\n 7395,\n 9515,\n 9703,\n 10009,\n 10829,\n 10871,\n 13145,\n 13418,\n 13509,\n 15034,\n 15134,\n 16287,\n 16294,\n 16384,\n 17590,\n 19054,\n 20588,\n 22027,\n 22083,\n 22831,\n 23102,\n 23532,\n 24697,\n 27229,\n 33177,\n 34461,\n 35671,\n 35688,\n 36746,\n 36749,\n 36753,\n 50202,\n 50209\n );\n\n script_name(english:\"Oracle Application Server Multiple Vulnerabilities\");\n script_summary(english:\"Checks version in Server response header.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server may be affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running Oracle Application Server. It was not possible\nto determine its version, so the version of Oracle Application Server\ninstalled on the remote host could potentially be affected by multiple\nvulnerabilities :\n\n - CVE-2000-0169: Remote command execution in the web\n listener component.\n\n - CVE-2000-1235: Information disclosure in the port\n listener component and modplsql.\n\n - CVE-2000-1236: SQL injection in mod_sql.\n\n - CVE-2001-0326: Information disclosure in the Java\n Virtual Machine.\n\n - CVE-2001-0419: Buffer overflow in ndwfn4.so.\n\n - CVE-2001-0591: Directory traversal.\n\n - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.\n\n - CVE-2001-1217: Directory traversal vulnerability in the\n PL/SQL Apache module.\n\n - CVE-2001-1371: Improper access control in the SOAP\n service.\n\n - CVE-2001-1372: Information disclosure.\n\n - CVE-2002-0386: Denial of service through the\n administration module for Oracle Web Cache.\n\n - CVE-2002-0559: Buffer overflows in the PL/SQL module.\n\n - CVE-2002-0560: Information disclosure in the PL/SQL\n module.\n\n - CVE-2002-0561: Authentication bypass in the PL/SQL\n Gateway web administration interface.\n\n - CVE-2002-0562: Information disclosure through\n globals.jsa.\n\n - CVE-2002-0563: Improper access control on several\n services.\n\n - CVE-2002-0564: Authentication bypass in the PL/SQL\n module.\n\n - CVE-2002-0565: Information disclosure through JSP files\n in the _pages directory.\n\n - CVE-2002-0566: Denial of service in the PL/SQL module.\n\n - CVE-2002-0568: Improper access control on XSQLConfig.xml\n and soapConfig.xml.\n\n - CVE-2002-0569: Authentication bypass through\n XSQLServlet.\n\n - CVE-2002-0655: Denial of service in OpenSSL.\n\n - CVE-2002-0656: Buffer overflows in OpenSSL.\n\n - CVE-2002-0659: Denial of service in OpenSSL.\n\n - CVE-2002-0840: Cross-site scripting in the default error\n page of Apache.\n\n - CVE-2002-0842: Format string vulnerability in mod_dav.\n\n - CVE-2002-0843: Buffer overflows in ApacheBench.\n\n - CVE-2002-0947: Buffer overflow in rwcgi60.\n\n - CVE-2002-1089: Information disclosure in rwcgi60.\n\n - CVE-2002-1630: Improper access control on sendmail.jsp.\n\n - CVE-2002-1631: SQL injection in query.xsql.\n\n - CVE-2002-1632: Information disclosure through several\n JSP pages.\n\n - CVE-2002-1635: Information disclosure in Apache.\n\n - CVE-2002-1636: Cross-site scripting in the htp PL/SQL\n package.\n\n - CVE-2002-1637: Default credentials in multiple\n components.\n\n - CVE-2002-1858: Information disclosure through the\n WEB-INF directory.\n\n - CVE-2002-2153: Format string vulnerability in the\n administrative pages of the PL/SQL module.\n\n - CVE-2002-2345: Credential leakage in the web cache\n administrator interface.\n\n - CVE-2002-2347: Cross-site scripting in several JSP\n pages.\n\n - CVE-2004-1362: Authentication bypass in the PL/SQL\n module.\n\n - CVE-2004-1363: Buffer overflow in extproc.\n\n - CVE-2004-1364: Directory traversal in extproc.\n\n - CVE-2004-1365: Command execution in extproc.\n\n - CVE-2004-1366: Improper access control on\n emoms.properties.\n\n - CVE-2004-1367: Credential leakage in Database Server.\n\n - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.\n\n - CVE-2004-1369: Denial of service in TNS Listener.\n\n - CVE-2004-1370: Multiple SQL injection vulnerabilities in\n PL/SQL.\n\n - CVE-2004-1371: Stack-based buffer overflow.\n\n - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.\n\n - CVE-2004-1774: Buffer overflow in the MD2 package.\n\n - CVE-2004-1877: Phishing vulnerability in Single Sign-On\n component.\n\n - CVE-2004-2134: Weak cryptography for passwords in the\n toplink mapping workBench.\n\n - CVE-2004-2244: Denial of service in the XML parser.\n\n - CVE-2005-1383: Authentication bypass in HTTP Server.\n\n - CVE-2005-1495: Detection bypass.\n\n - CVE-2005-1496: Privilege escalation in the\n DBMS_Scheduler.\n\n - CVE-2005-2093: Web cache poisoning.\n\n - CVE-2005-3204: Cross-site scripting.\n\n - CVE-2005-3445: Multiple unspecified vulnerabilities in\n HTTP Server.\n\n - CVE-2005-3446: Unspecified vulnerability in Internet\n Directory.\n\n - CVE-2005-3447: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2005-3448: Unspecified vulnerability in the OC4J\n module.\n\n - CVE-2005-3449: Multiple unspecified vulnerabilities in\n multiple components.\n\n - CVE-2005-3450: Unspecified vulnerability in HTTP Server.\n\n - CVE-2005-3451: Unspecified vulnerability in\n SQL*ReportWriter.\n\n - CVE-2005-3452: Unspecified vulnerability in Web Cache.\n\n - CVE-2005-3453: Multiple unspecified vulnerabilities in\n Web Cache.\n\n - CVE-2006-0273: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2006-0274: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2006-0275: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2006-0282: Unspecified vulnerability.\n\n - CVE-2006-0283: Unspecified vulnerability.\n\n - CVE-2006-0284: Multiple unspecified vulnerabilities.\n\n - CVE-2006-0285: Unspecified vulnerability in the Java Net\n component.\n\n - CVE-2006-0286: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-0287: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-0288: Multiple unspecified vulnerabilities in\n the Oracle Reports Developer component.\n\n - CVE-2006-0289: Multiple unspecified vulnerabilities.\n\n - CVE-2006-0290: Unspecified vulnerability in the Oracle\n Workflow Cartridge component.\n\n - CVE-2006-0291: Multiple unspecified vulnerabilities in\n the Oracle Workflow Cartridge component.\n\n - CVE-2006-0435: Unspecified vulnerability in Oracle\n PL/SQL.\n\n - CVE-2006-0552: Unspecified vulnerability in the Net\n Listener component.\n\n - CVE-2006-0586: Multiple SQL injection vulnerabilities.\n\n - CVE-2006-1884: Unspecified vulnerability in the Oracle\n Thesaurus Management System component.\n\n - CVE-2006-3706: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3707: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3708: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3709: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3710: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3711: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3712: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3713: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-3714: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5353: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5354: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5355: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2006-5356: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5357: Unspecified vulnerability in HTTP Server.\n\n - CVE-2006-5358: Unspecified vulnerability in the Oracle\n Forms component.\n\n - CVE-2006-5359: Multiple unspecified vulnerabilities in\n Oracle Reports Developer component.\n\n - CVE-2006-5360: Unspecified vulnerability in Oracle Forms\n component.\n\n - CVE-2006-5361: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5362: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5363: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2006-5364: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2006-5365: Unspecified vulnerability in Oracle\n Forms.\n\n - CVE-2006-5366: Multiple unspecified vulnerabilities.\n\n - CVE-2007-0222: Directory traversal vulnerability in\n EmChartBean.\n\n - CVE-2007-0275: Cross-site scripting vulnerability in\n Oracle Reports Web Cartridge (RWCGI60).\n\n - CVE-2007-0280: Buffer overflow in Oracle Notification\n Service.\n\n - CVE-2007-0281: Multiple unspecified vulnerabilities in\n HTTP Server.\n\n - CVE-2007-0282: Unspecified vulnerability in OPMN02.\n\n - CVE-2007-0283: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0284: Multiple unspecified vulnerabilities in\n Oracle Containers for J2EE.\n\n - CVE-2007-0285: Unspecified vulnerability in Oracle\n Reports Developer.\n\n - CVE-2007-0286: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0287: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-0288: Unspecified vulnerability in Oracle\n Internet Directory.\n\n - CVE-2007-0289: Multiple unspecified vulnerabilities in\n Oracle Containers for J2EE.\n\n - CVE-2007-1359: Improper access control in mod_security.\n\n - CVE-2007-1609: Cross-site scripting vulnerability in\n servlet/Spy in Dynamic Monitoring Services (DMS).\n\n - CVE-2007-2119: Cross-site scripting vulnerability in the\n Administration Front End for Oracle Enterprise (Ultra)\n Search.\n\n - CVE-2007-2120: Denial of service in the Oracle\n Discoverer servlet.\n\n - CVE-2007-2121: Unspecified vulnerability in the COREid\n Access component.\n\n - CVE-2007-2122: Unspecified vulnerability in the Wireless\n component.\n\n - CVE-2007-2123: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2007-2124: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2007-2130: Unspecified vulnerability in Workflow\n Cartridge.\n\n - CVE-2007-3553: Cross-site scripting vulnerability in\n Rapid Install Web Server.\n\n - CVE-2007-3854: Multiple unspecified vulnerabilities in\n the Advanced Queuing component and the Spatial\n component.\n\n - CVE-2007-3859: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-3861: Unspecified vulnerability in Oracle\n Jdeveloper.\n\n - CVE-2007-3862: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-3863: Unspecified vulnerability in Oracle\n JDeveloper.\n\n - CVE-2007-5516: Unspecified vulnerability in the Oracle\n Process Mgmt & Notification component.\n\n - CVE-2007-5517: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5518: Unspecified vulnerability in HTTP Server.\n\n - CVE-2007-5519: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5520: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-5521: Unspecified vulnerability in Oracle\n Containers for J2EE.\n\n - CVE-2007-5522: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5523: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2007-5524: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-5525: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2007-5526: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2007-5531: Unspecified vulnerability in Oracle Help\n for Web.\n\n - CVE-2008-0340: Multiple unspecified vulnerabilities in\n the Advanced Queuing component and Spatial component.\n\n - CVE-2008-0343: Unspecified vulnerability in the Oracle\n Spatial component.\n\n - CVE-2008-0344: Unspecified vulnerability in the Oracle\n Spatial component.\n\n - CVE-2008-0345: Unspecified vulnerability in the Core\n RDBMS component.\n\n - CVE-2008-0346: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2008-0347: Unspecified vulnerability in the Oracle\n Ultra Search component.\n\n - CVE-2008-0348: Multiple unspecified vulnerabilities in\n the PeopleTools component.\n\n - CVE-2008-0349: Unspecified vulnerability in the\n PeopleTools component.\n\n - CVE-2008-1812: Unspecified vulnerability in the Oracle\n Enterprise Manager component.\n\n - CVE-2008-1814: Unspecified vulnerability in the Oracle\n Secure Enterprise Search or Ultrasearch component.\n\n - CVE-2008-1823: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2008-1824: Unspecified vulnerability in the Oracle\n Dynamic Monitoring Service component.\n\n - CVE-2008-1825: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2583: Unspecified vulnerability in the sample\n Discussion Forum Portlet for the Oracle Portal\n component.\n\n - CVE-2008-2588: Unspecified vulnerability in the Oracle\n JDeveloper component.\n\n - CVE-2008-2589: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2593: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2594: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2595: Unspecified vulnerability in the Oracle\n Internet Directory component.\n\n - CVE-2008-2609: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-2612: Unspecified vulnerability in the Hyperion\n BI Plus component.\n\n - CVE-2008-2614: Unspecified vulnerability in HTTP Server.\n\n - CVE-2008-2619: Unspecified vulnerability in the Oracle\n Reports Developer component.\n\n - CVE-2008-2623: Unspecified vulnerability in the Oracle\n JDeveloper component.\n\n - CVE-2008-3975: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-3977: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-3986: Unspecified vulnerability in the Oracle\n Discoverer Administrator component.\n\n - CVE-2008-3987: Unspecified vulnerability in the Oracle\n Discoverer Desktop component.\n\n - CVE-2008-4014: Unspecified vulnerability in the Oracle\n BPEL Process Manager component.\n\n - CVE-2008-4017: Unspecified vulnerability in the OC4J\n component.\n\n - CVE-2008-5438: Unspecified vulnerability in the Oracle\n Portal component.\n\n - CVE-2008-7233: Unspecified vulnerability in the Oracle\n Jinitiator component.\n\n - CVE-2009-0217: Signature spoofing vulnerability in\n multiple components.\n\n - CVE-2009-0989: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-0990: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-0994: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-1008: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1009: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1010: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1011: Unspecified vulnerability in the Outside\n In Technology component.\n\n - CVE-2009-1017: Unspecified vulnerability in the BI\n Publisher component.\n\n - CVE-2009-1976: Unspecified vulnerability in HTTP Server.\n\n - CVE-2009-1990: Unspecified vulnerability in the Business\n Intelligence Enterprise Edition component.\n\n - CVE-2009-1999: Unspecified vulnerability in the Business\n Intelligence Enterprise Edition component.\n\n - CVE-2009-3407: Unspecified vulnerability in the Portal\n component.\n\n - CVE-2009-3412: Unspecified vulnerability in the Unzip\n component.\n\n - CVE-2010-0066: Unspecified vulnerability in the Access\n Manager Identity Server component.\n\n - CVE-2010-0067: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2010-0070: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2011-0789: Unspecified vulnerability in HTTP Server.\n\n - CVE-2011-0795: Unspecified vulnerability in Single\n Sign-On.\n\n - CVE-2011-0884: Unspecified vulnerability in the Oracle\n BPEL Process Manager component.\n\n - CVE-2011-2237: Unspecified vulnerability in the Oracle\n Web Services Manager component.\n\n - CVE-2011-2314: Unspecified vulnerability in the Oracle\n Containers for J2EE component.\n\n - CVE-2011-3523: Unspecified vulnerability in the Oracle\n Web Services Manager component.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Verify that the version of Oracle Application Server installed is not\naffected by the listed vulnerabilities and/or filter incoming traffic to this port\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"manual\");\n script_set_attribute(attribute:\"cvss_score_rationale\", value:\"remote code execution\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploithub_sku\", value:\"EH-11-053\");\n script_set_attribute(attribute:\"exploit_framework_exploithub\", value:\"true\");\n script_set_attribute(attribute:\"d2_elliot_name\", value:\"Oracle Secure Backup 10.2.0.2 RCE (Windows)\");\n script_set_attribute(attribute:\"exploit_framework_d2_elliot\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 79, 119, 200, 255, 264, 287);\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2000/03/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/24\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:application_server\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Web Servers\");\n\n script_copyright(english:\"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"find_service2.nasl\");\n script_require_keys(\"Settings/PCI_DSS\", \"Settings/ParanoidReport\");\n script_require_ports(\"Services/oracle_application_server\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"http.inc\");\ninclude(\"misc_func.inc\");\n\n# Only PCI considers this an issue.\nif (!get_kb_item(\"Settings/PCI_DSS\")) exit(0, \"PCI-DSS compliance checking is not enabled.\");\n\n# Make sure this is Oracle.\nport = get_kb_item_or_exit(\"Services/oracle_application_server\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# We're flagging every installation of Oracle Application Server, with\n# every vulnerability it has ever had.\nsecurity_hole(port);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cert": [{"lastseen": "2020-05-27T18:59:23", "bulletinFamily": "info", "description": "### Overview \n\nOracle Application Server 9iAS allows remote users to access several Apache services without authentication.\n\n### Description \n\nOracle Application Server 9iAS includes the Apache Web server and several Apache services. In the default install configuration, many of these services, including Dynamic Monitoring Services, can be accessed remotely by anonymous users. \n \n--- \n \n### Impact \n\nDynamic Monitoring Services may be used without authentication by attackers to monitor the internal workings of the Oracle server. \n \n--- \n \n### Solution \n\nThe CERT/CC is currently unaware of a practical solution to this problem. \n \n--- \n \nThe following workaround was suggested by David Litchfield and has not been tested by CERT/CC.\n\nEdit the \"httpd.conf\" file to limit access to the following pages: \n\n\n> http://oracleserver/dms0http://oracleserver/dms/DMSDumphttp://oracleserver/servlet/DMSDumphttp://oracleserver/servlet/Spyhttp://oracleserver/soap/servlet/Spyhttp://oracleserver/dms/AggreSpyhttp://oracleserver/oprocmgr-statushttp://oracleserver/oprocmgr-service \n \n--- \n \n### Vendor Information\n\n168795\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Vendor has issued information\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### Oracle Corporation __ Affected\n\nNotified: February 08, 2002 Updated: February 26, 2002 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\n\"The info is correct: please link to Alert #28 at <http://otn.oracle.com/deploy/security/alerts.htm>.\"\n\n### Vendor Information \n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nThe CERT/CC has no additional comments at this time.\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23168795 Feedback>).\n\n \n\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | | N/A \n \n \n\n\n### References \n\n * <http://www.nextgenss.com/papers/hpoas.pdf>\n * <http://otn.oracle.com/deploy/security/alerts.htm>\n * <http://online.securityfocus.com/bid/4293>\n\n### Acknowledgements\n\nThanks to David Litchfield for reporting this vulnerability.\n\nThis document was written by Shawn Van Ittersum.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2002-0563](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0563>) \n---|--- \n**Severity Metric:** | 11.25 \n**Date Public:** | 2002-01-10 \n**Date First Published:** | 2002-03-12 \n**Date Last Updated: ** | 2003-04-09 19:19 UTC \n**Document Revision: ** | 13 \n", "modified": "2003-04-09T19:19:00", "published": "2002-03-12T00:00:00", "id": "VU:168795", "href": "https://www.kb.cert.org/vuls/id/168795", "type": "cert", "title": "Oracle 9iAS allows anonymous remote users to view sensitive Apache services by default", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "openvas": [{"lastseen": "2017-12-08T11:44:12", "bulletinFamily": "scanner", "description": "In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.", "modified": "2017-12-07T00:00:00", "published": "2005-11-03T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=10848", "id": "OPENVAS:10848", "title": "Oracle 9iAS Dynamic Monitoring Services", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: oracle9i_apache_dms.nasl 8023 2017-12-07 08:36:26Z teissa $\n# Description: Oracle 9iAS Dynamic Monitoring Services\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_summary = \"In a default installation of Oracle 9iAS, it is possible to access the \nDynamic Monitoring Services pages anonymously. Access to these pages \nshould be restricted.\";\n\ntag_solution = \"Edit httpd.conf to restrict access to /dms0.\";\n\nif(description)\n{\n script_id(10848);\n script_version(\"$Revision: 8023 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-07 09:36:26 +0100 (Thu, 07 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n name = \"Oracle 9iAS Dynamic Monitoring Services\";\n script_name(name);\n \n \n \n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"remote_analysis\");\n \n script_copyright(\"This script is Copyright (C) 2002 Matt Moore\");\n family = \"Web application abuses\";\n script_family(family);\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\"); \n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\n\nif(get_port_state(port))\n{ \n req = http_get(item:\"/dms0\", port:port);\t \n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"DMSDUMP version\" >< r)\t\n \tsecurity_message(port);\n\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2020-05-12T15:08:22", "bulletinFamily": "scanner", "description": "The remote host is an Oracle 9iAS server. It is possible to\n obtain the list of Java processes running on the remote host anonymously, as well as to start\n and stop them.", "modified": "2020-05-08T00:00:00", "published": "2005-11-03T00:00:00", "id": "OPENVAS:136141256231010851", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231010851", "title": "Oracle 9iAS Java Process Manager", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Oracle 9iAS Java Process Manager\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nCPE = \"cpe:/a:oracle:http_server\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.10851\");\n script_version(\"2020-05-08T08:34:44+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-08 08:34:44 +0000 (Fri, 08 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n script_name(\"Oracle 9iAS Java Process Manager\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2002 Matt Moore\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_oracle_app_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"oracle/http_server/detected\");\n\n script_tag(name:\"solution\", value:\"Restrict access to /oprocmgr-status in httpd.conf\");\n\n script_tag(name:\"summary\", value:\"The remote host is an Oracle 9iAS server. It is possible to\n obtain the list of Java processes running on the remote host anonymously, as well as to start\n and stop them.\");\n\n script_tag(name:\"impact\", value:\"By default, accessing the location /oprocmgr-status via HTTP\n lets an attacker obtain the list of processes running on the remote host, and even to start\n or stop them.\");\n\n script_tag(name:\"solution_type\", value:\"Mitigation\");\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!port = get_app_port(cpe:CPE))\n exit(0);\n\nif(!get_app_location(cpe:CPE, port:port))\n exit(0);\n\nurl = \"/oprocmgr-status\";\nreq = http_get(item:url, port:port);\nres = http_send_recv(port:port, data:req);\nif(res && \"Module Name\" >< res) {\n report = http_report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2017-12-08T11:44:11", "bulletinFamily": "scanner", "description": "It is possible to obtain the list of Java processes running on the\nremote host anonymously, as well as to start and stop them.\n\nDescription :\n\nThe remote host is an Oracle 9iAS server. By default, accessing\nthe location /oprocmgr-status via HTTP lets an attacker obtain\nthe list of processes running on the remote host, and even to\nto start or stop them.", "modified": "2017-12-07T00:00:00", "published": "2005-11-03T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=10851", "id": "OPENVAS:10851", "title": "Oracle 9iAS Java Process Manager", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: oracle9i_java_process_manager.nasl 8023 2017-12-07 08:36:26Z teissa $\n# Description: Oracle 9iAS Java Process Manager\n#\n# Authors:\n# Matt Moore <matt.moore@westpoint.ltd.uk>\n# Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>\n# Erik Anderson <eanders@carmichaelsecurity.com>\n# Added BugtraqID and CAN\n#\n# Copyright:\n# Copyright (C) 2002 Matt Moore\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_summary = \"It is possible to obtain the list of Java processes running on the\nremote host anonymously, as well as to start and stop them.\n\nDescription :\n\nThe remote host is an Oracle 9iAS server. By default, accessing\nthe location /oprocmgr-status via HTTP lets an attacker obtain\nthe list of processes running on the remote host, and even to\nto start or stop them.\";\n\ntag_solution = \"Restrict access to /oprocmgr-status in httpd.conf\";\n\nif(description)\n{\n script_id(10851);\n script_version(\"$Revision: 8023 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-07 09:36:26 +0100 (Thu, 07 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4293);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2002-0563\");\n name = \"Oracle 9iAS Java Process Manager\";\n script_name(name);\n \n \n \n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n \n script_copyright(\"This script is Copyright (C) 2002 Matt Moore\");\n family = \"Web application abuses\";\n script_family(family);\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/OracleApache\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n# Check starts here\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\n\n\nif(get_port_state(port))\n{ \n# Make a request for /oprocmgr-status\n\n req = http_get(item:\"/oprocmgr-status\", port:port);\n soc = http_open_socket(port);\n if(soc)\n {\n send(socket:soc, data:req);\n r = http_recv(socket:soc);\n http_close_socket(soc);\n if(\"Module Name\" >< r)\t\n \tsecurity_message(port);\n\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "osvdb": [{"lastseen": "2017-04-28T13:19:55", "bulletinFamily": "software", "description": "## Vulnerability Description\nOracle Application Server contains a flaw that may lead to an unauthorized information disclosure. \u00a0The issue is triggered when a remote unauthenticated attacker directly accesses the Apache HTTP server Dynamic Monitoring Services, which will disclose sensitive information about the server, resulting in a loss of confidentiality.\n## Technical Description\nThese administrative web pages are rarely used in a production environment, so denying all access to them is acceptable. The following directives should be added to the Apache httpd.conf file to achieve this.\n\n <location /dms0>\n order allow,deny\n deny from all\n </location>\n <location /dms/DMSDump>\n order allow,deny\n deny from all\n </location>\n <location /servlet/DMSDump>\n order allow,deny\n deny from all\n </location>\n <location /servlet/Spy>\n order allow,deny\n deny from all\n </location>\n <location /soap/servlet/Spy>\n order allow,deny\n deny from all\n </location>\n <location /dms/AggreSpy>\n order allow,deny\n deny from all\n </location>\n## Solution Description\nCurrently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): \n\nEdit httpd.conf to prevent access to the following pages.\n\nDynamic Monitoring Services\nhttp://oracleserver/dms0\nhttp://oracleserver/dms/DMSDump\nhttp://oracleserver/servlet/DMSDump\nhttp://oracleserver/servlet/Spy\nhttp://oracleserver/soap/servlet/Spy\nhttp://oracleserver/dms/AggreSpy\n## Short Description\nOracle Application Server contains a flaw that may lead to an unauthorized information disclosure. \u00a0The issue is triggered when a remote unauthenticated attacker directly accesses the Apache HTTP server Dynamic Monitoring Services, which will disclose sensitive information about the server, resulting in a loss of confidentiality.\n## Manual Testing Notes\nhttp://[victim]/dms0\n## References:\n[Vendor Specific Advisory URL](http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf)\nSnort Signature ID: 1872\nSecurity Tracker: 1009167\nOther Advisory URL: http://www.nextgenss.com/papers/hpoas.pdf\n[Nessus Plugin ID:10848](https://vulners.com/search?query=pluginID:10848)\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=101301813117562&w=2\nISS X-Force ID: 8455\n[CVE-2002-0563](https://vulners.com/cve/CVE-2002-0563)\nCERT VU: 168795\nBugtraq ID: 4293\n", "modified": "2002-01-10T00:00:00", "published": "2002-01-10T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:705", "id": "OSVDB:705", "title": "Oracle 9iAS Dynamic Monitoring Services /dms0 Anonymous Access", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}]}