PT-2004-2279 · Oracle · Oracle Application Server 10G+1

David Litchfield · Published 2004-08-04 · Updated 2017-07-11 · CVE-2004-1362

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle Application Server 10g

Description: The issue concerns the PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g. When using the WE8ISO8859P1 character set, it fails to perform character conversions correctly. This allows remote attackers to bypass access restrictions for certain procedures by using an encoded URL that contains "%FF" encoded sequences. These sequences are improperly converted to "Y" characters.

Recommendations: For Oracle Application Server 10g, consider disabling the use of the WE8ISO8859P1 character set until a proper fix is available, or apply configuration changes to correctly handle character conversions for the PL/SQL module.

Fix

Related Identifiers

CVE-2004-1362

Affected Products

Oracle Application Server 10G

Oracle Http Server

References · 10

• http://ngssoftware.com/advisories/oracle23122004G.txt · Vendor Advisory
• http://securityfocus.com/bid/10871 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1362 · Security Note
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA04-245A.html · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1362 · Note
• http://marc.info/?l=bugtraq&m=110382306006205&w=2 · Note
• http://kb.cert.org/vuls/id/435974 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18657 · Note