PT-2005-3035 · Oracle · Oracle9Ias

Publicado 2005-06-30 · Atualizado 2017-07-11 · CVE-2005-2093

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Oracle 9i Application Server (Oracle9iAS) version 9.0.2

Description: The issue allows remote attackers to conduct HTTP Request Smuggling attacks by sending an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header. This causes the Application Server to incorrectly handle and forward the body of the request, allowing attackers to bypass web application firewall protection and potentially conduct XSS attacks.

Recommendations: For Oracle 9i Application Server (Oracle9iAS) version 9.0.2, consider restricting access to the HTTP request handling module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the Transfer-Encoding: chunked header and Content-Length header in the same HTTP request.

Exploit

Correção

Identificadores relacionados

CVE-2005-2093

Produtos afetados

Oracle9Ias

Referências · 6

• 🔥 http://securiteam.com/securityreviews/5GP0220G0U.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2093 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42902 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2093 · Nota
• http://seclists.org/lists/bugtraq/2005/Jun/0025.html · Nota
• http://watchfire.com/resources/HTTP-Request-Smuggling.pdf · Nota