PT-2001-1551 · Oracle · Oracle Application Server 9Ias+1

Published 2001-05-03 · Updated 2017-10-10 · CVE-2001-0326

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java Virtual Machine (JVM) for Oracle versions 8.1.7 Oracle Application Server 9iAS version 1.0.2.0.1

Description The issue allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the ALL FILES FilePermission.

Recommendations For Oracle Java Virtual Machine (JVM) for Oracle version 8.1.7, consider restricting access to .jsp and .sqljsp files until a fix is available. For Oracle Application Server 9iAS version 1.0.2.0.1, restrict the use of the ALL FILES FilePermission to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2001-0326

Affected Products

Oracle Application Server 9Ias

Oracle Java Virtual Machine

References · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-02/0255.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0326 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6438 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0326 · Note
• http://osvdb.org/5706 · Note