PT-2002-1103 · Oracle · Oracle Application Server 9Ias

Published 2002-02-06 · Updated 2016-10-18 · CVE-2001-1371

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Application Server 9iAS version 1.0.2.2

Description The default configuration of the software enables SOAP and allows anonymous users to deploy applications by default via "urn:soap-service-manager" and "urn:soap-provider-manager" API endpoints.

Recommendations For Oracle Application Server 9iAS version 1.0.2.2, consider disabling the anonymous deployment of applications via the "urn:soap-service-manager" and "urn:soap-provider-manager" API endpoints to minimize the risk of exploitation. Restrict access to these endpoints to prevent unauthorized application deployment.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2001-1371

Affected Products

Oracle Application Server 9Ias

References · 9

• 🔥 http://securityfocus.com/bid/4289 · Exploit
• http://cert.org/advisories/CA-2002-08.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2001-1371 · Security Note
• http://marc.info/?l=bugtraq&m=101301813117562&w=2 · Note
• http://nextgenss.com/papers/hpoas.pdf · Note
• http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1371 · Note
• http://iss.net/security_center/static/8449.php · Note
• http://kb.cert.org/vuls/id/736923 · Note