PT-2002-1613 · Oracle · Oracle 9I Application Server

Publicado 2002-06-11 · Atualizado 2017-07-11 · CVE-2002-0563

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server version 1.0.2.x

Description The default configuration of the server allows remote anonymous users to access sensitive services without authentication. This includes access to Dynamic Monitoring Services such as dms0, dms/DMSDump, servlet/DMSDump, servlet/Spy, soap/servlet/Spy, and dms/AggreSpy. Additionally, Oracle Java Process Manager services like oprocmgr-status and oprocmgr-service can be accessed, which can be used to control Java processes.

Recommendations For Oracle 9i Application Server version 1.0.2.x, consider reconfiguring the server to require authentication for access to sensitive services, including Dynamic Monitoring Services and Oracle Java Process Manager. As a temporary workaround, restrict access to these services to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2002-0563

Produtos afetados

Oracle 9I Application Server

Referências · 13

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0563 · Nota
• http://appsecinc.com/Policy/PolicyCheck7024.html · Nota
• http://securitytracker.com/id?1009167 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0563 · Nota de Segurança
• http://osvdb.org/705 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8455 · Nota
• http://cert.org/advisories/CA-2002-08.html · Correção
• http://osvdb.org/13152 · Nota
• http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf · Aviso do Fabricante
• http://kb.cert.org/vuls/id/168795 · Nota
• http://nextgenss.com/papers/hpoas.pdf · Nota
• http://marc.info/?l=bugtraq&m=101301813117562&w=2 · Nota
• http://securityfocus.com/bid/4293 · Aviso do Fabricante