PT-2002-1103 · Oracle · Oracle Application Server 9Ias

Publicado 2002-02-06 · Atualizado 2016-10-18 · CVE-2001-1371

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Application Server 9iAS version 1.0.2.2

Description The default configuration of the software enables SOAP and allows anonymous users to deploy applications by default via "urn:soap-service-manager" and "urn:soap-provider-manager" API endpoints.

Recommendations For Oracle Application Server 9iAS version 1.0.2.2, consider disabling the anonymous deployment of applications via the "urn:soap-service-manager" and "urn:soap-provider-manager" API endpoints to minimize the risk of exploitation. Restrict access to these endpoints to prevent unauthorized application deployment.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2001-1371

Produtos afetados

Oracle Application Server 9Ias

Referências · 9

• 🔥 http://securityfocus.com/bid/4289 · Exploit
• http://marc.info/?l=bugtraq&m=101301813117562&w=2 · Nota
• http://cert.org/advisories/CA-2002-08.html · Correção
• http://nextgenss.com/papers/hpoas.pdf · Nota
• http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1371 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1371 · Nota de Segurança
• http://iss.net/security_center/static/8449.php · Nota
• http://kb.cert.org/vuls/id/736923 · Nota