PT-2002-1104 · Oracle · Oracle 9I Application Server

Publicado 2002-02-06 · Atualizado 2017-10-10 · CVE-2001-1372

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server version 1.0.2

Description The issue allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file. This is achieved by the server leaking the pathname in an error message when such a request is made.

Recommendations For Oracle 9i Application Server version 1.0.2, consider restricting access to .JSP files to minimize the risk of exploitation, and review server configuration to prevent leakage of sensitive path information in error messages.

Exploit

Correção

Identificadores relacionados

CVE-2001-1372

Produtos afetados

Oracle 9I Application Server

Referências · 10

• 🔥 http://securityfocus.com/bid/3341 · Exploit
• http://nii.co.in/research.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7135 · Nota
• http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1372 · Nota
• http://marc.info/?l=bugtraq&m=100119633925473&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1372 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=100074087824021&w=2 · Nota
• http://kb.cert.org/vuls/id/278971 · Nota
• http://cert.org/advisories/CA-2002-08.html · Nota