PT-2002-1613 · Oracle · Oracle 9I Application Server

Published 2002-06-11 · Updated 2017-07-11 · CVE-2002-0563

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server version 1.0.2.x

Description The default configuration of the server allows remote anonymous users to access sensitive services without authentication. This includes access to Dynamic Monitoring Services such as dms0, dms/DMSDump, servlet/DMSDump, servlet/Spy, soap/servlet/Spy, and dms/AggreSpy. Additionally, Oracle Java Process Manager services like oprocmgr-status and oprocmgr-service can be accessed, which can be used to control Java processes.

Recommendations For Oracle 9i Application Server version 1.0.2.x, consider reconfiguring the server to require authentication for access to sensitive services, including Dynamic Monitoring Services and Oracle Java Process Manager. As a temporary workaround, restrict access to these services to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2002-0563

Affected Products

Oracle 9I Application Server

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2002-0563 · Security Note
• http://cert.org/advisories/CA-2002-08.html · Patch
• http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf · Vendor Advisory
• http://securityfocus.com/bid/4293 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0563 · Note
• http://appsecinc.com/Policy/PolicyCheck7024.html · Note
• http://securitytracker.com/id?1009167 · Note
• http://osvdb.org/705 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8455 · Note
• http://osvdb.org/13152 · Note
• http://kb.cert.org/vuls/id/168795 · Note
• http://nextgenss.com/papers/hpoas.pdf · Note
• http://marc.info/?l=bugtraq&m=101301813117562&w=2 · Note