PT-2002-1104 · Oracle · Oracle 9I Application Server

Published 2002-02-06 · Updated 2017-10-10 · CVE-2001-1372

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server version 1.0.2

Description The issue allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file. This is achieved by the server leaking the pathname in an error message when such a request is made.

Recommendations For Oracle 9i Application Server version 1.0.2, consider restricting access to .JSP files to minimize the risk of exploitation, and review server configuration to prevent leakage of sensitive path information in error messages.

Exploit

Fix

Related Identifiers

CVE-2001-1372

Affected Products

Oracle 9I Application Server

References · 10

• 🔥 http://securityfocus.com/bid/3341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1372 · Security Note
• http://nii.co.in/research.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7135 · Note
• http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1372 · Note
• http://marc.info/?l=bugtraq&m=100119633925473&w=2 · Note
• http://marc.info/?l=bugtraq&m=100074087824021&w=2 · Note
• http://kb.cert.org/vuls/id/278971 · Note
• http://cert.org/advisories/CA-2002-08.html · Note