PT-2004-2776 · Oracle · Oracle 9I Application Server

Published 2004-03-30 · Updated 2017-07-11 · CVE-2004-1877

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server (9iAS) version 9.0.2

Description The issue allows remote attackers to spoof the login page, potentially causing users to inadvertently reveal their username and password. This is due to the p submit url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide.

Recommendations For Oracle 9i Application Server (9iAS) version 9.0.2, consider modifying the p submit url value in the sample login form to prevent spoofing of the login page. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1877

Affected Products

Oracle 9I Application Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-1877 · Security Note
• http://securityfocus.com/bid/10009 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=108067040722235&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15676 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1877 · Note