PT-2004-2776 · Oracle · Oracle 9I Application Server

Publicado 2004-03-30 · Atualizado 2017-07-11 · CVE-2004-1877

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server (9iAS) version 9.0.2

Description The issue allows remote attackers to spoof the login page, potentially causing users to inadvertently reveal their username and password. This is due to the p submit url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide.

Recommendations For Oracle 9i Application Server (9iAS) version 9.0.2, consider modifying the p submit url value in the sample login form to prevent spoofing of the login page. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-1877

Produtos afetados

Oracle 9I Application Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-1877 · Nota de Segurança
• http://securityfocus.com/bid/10009 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108067040722235&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15676 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1877 · Nota