PT-2002-1444 · Oracle · Oracle9Ias+1

Published 2002-10-29 · Updated 2008-09-10 · CVE-2002-0386

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle9iAS (9i Application Suite) version 9.0.2

Description The issue affects the administration module for Oracle Web Cache, allowing remote attackers to cause a denial of service (crash) through specific HTTP requests. This can be achieved by sending either an HTTP GET request containing a ".." (dot dot) sequence or a malformed HTTP GET request with a chunked Transfer-Encoding that has missing data.

Recommendations For Oracle9iAS (9i Application Suite) version 9.0.2, consider restricting access to the administration module for Oracle Web Cache to minimize the risk of exploitation. As a temporary workaround, restrict the handling of HTTP GET requests containing ".." sequences or chunked Transfer-Encoding with missing data until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2002-0386

Affected Products

Oracle Web Cache

Oracle9Ias

References · 7

• 🔥 https://exploit-db.com/exploits/21911 · Exploit
• 🔥 http://atstake.com/research/advisories/2002/a102802-1.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0386 · Security Note
• http://otn.oracle.com/deploy/security/pdf/2002alert43rev1.pdf · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0386 · Note
• http://securityfocus.com/bid/5902 · Note
• http://iss.net/security_center/static/10284.php · Note