PT-2002-2360 · Apache+1 · Apache+1

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1635

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server (9iAS)

Description The issue arises from the Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS), where a Location alias is used for the /perl directory instead of a ScriptAlias. This configuration allows remote attackers to read the source code of arbitrary CGI files by accessing a URL that contains the /perl directory instead of /cgi-bin.

Recommendations For Oracle 9i Application Server (9iAS), consider modifying the Apache configuration file (httpd.conf) to use a ScriptAlias for the /perl directory instead of a Location alias to prevent remote attackers from reading the source code of arbitrary CGI files.

Fix

Related Identifiers

CVE-2002-1635

Affected Products

Apache

Oracle 9I Application Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1635 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10716 · Note
• http://kb.cert.org/vuls/id/936507 · Note
• http://nextgenss.com/papers/hpoas.pdf · Note