PT-2001-1551 · Oracle · Oracle Application Server 9Ias+1

Publicado 2001-05-03 · Atualizado 2017-10-10 · CVE-2001-0326

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java Virtual Machine (JVM) for Oracle versions 8.1.7 Oracle Application Server 9iAS version 1.0.2.0.1

Description The issue allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the ALL FILES FilePermission.

Recommendations For Oracle Java Virtual Machine (JVM) for Oracle version 8.1.7, consider restricting access to .jsp and .sqljsp files until a fix is available. For Oracle Application Server 9iAS version 1.0.2.0.1, restrict the use of the ALL FILES FilePermission to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-0326

Produtos afetados

Oracle Application Server 9Ias

Oracle Java Virtual Machine

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-02/0255.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6438 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0326 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0326 · Nota de Segurança
• http://osvdb.org/5706 · Nota