PT-2004-2279 · Oracle · Oracle Application Server 10G+1

David Litchfield · Publicado 2004-08-04 · Atualizado 2017-07-11 · CVE-2004-1362

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle Application Server 10g

Description: The issue concerns the PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g. When using the WE8ISO8859P1 character set, it fails to perform character conversions correctly. This allows remote attackers to bypass access restrictions for certain procedures by using an encoded URL that contains "%FF" encoded sequences. These sequences are improperly converted to "Y" characters.

Recommendations: For Oracle Application Server 10g, consider disabling the use of the WE8ISO8859P1 character set until a proper fix is available, or apply configuration changes to correctly handle character conversions for the PL/SQL module.

Correção

Identificadores relacionados

CVE-2004-1362

Produtos afetados

Oracle Application Server 10G

Oracle Http Server

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1362 · Nota
• http://ngssoftware.com/advisories/oracle23122004G.txt · Aviso do Fabricante
• http://securityfocus.com/bid/10871 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2004-1362 · Nota de Segurança
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA04-245A.html · Correção
• http://marc.info/?l=bugtraq&m=110382306006205&w=2 · Nota
• http://kb.cert.org/vuls/id/435974 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18657 · Nota