PT-2002-1444 · Oracle · Oracle9Ias+1

Publicado 2002-10-29 · Atualizado 2008-09-10 · CVE-2002-0386

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle9iAS (9i Application Suite) version 9.0.2

Description The issue affects the administration module for Oracle Web Cache, allowing remote attackers to cause a denial of service (crash) through specific HTTP requests. This can be achieved by sending either an HTTP GET request containing a ".." (dot dot) sequence or a malformed HTTP GET request with a chunked Transfer-Encoding that has missing data.

Recommendations For Oracle9iAS (9i Application Suite) version 9.0.2, consider restricting access to the administration module for Oracle Web Cache to minimize the risk of exploitation. As a temporary workaround, restrict the handling of HTTP GET requests containing ".." sequences or chunked Transfer-Encoding with missing data until a fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-0386

Produtos afetados

Oracle Web Cache

Oracle9Ias

Referências · 7

• 🔥 https://exploit-db.com/exploits/21911 · Exploit
• 🔥 http://atstake.com/research/advisories/2002/a102802-1.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0386 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0386 · Nota
• http://securityfocus.com/bid/5902 · Nota
• http://otn.oracle.com/deploy/security/pdf/2002alert43rev1.pdf · Aviso do Fabricante
• http://iss.net/security_center/static/10284.php · Nota