Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
BID:14273
Info
Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
| Bugtraq ID: | 14273 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 15 2005 12:00AM |
| Updated: | Jul 15 2005 12:00AM |
| Credit: | This issue was announced by Oracle. |
| Vulnerable: |
Oracle Oracle HTTP Server 9.0.2 .3 |
| Not Vulnerable: | |
Discussion
Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
The Oracle HTTP Server mod_osso single sign-on module does not properly expire partner application cookies. This could present a security threat if a malicious user has a means to gain unauthorized access to partner application cookies. The expected behavior is that application cookies will expire.
This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. Oracle has not released any further information about this weakness. This issue could be related to vulnerability DB10 in the Critical Patch Update for July, though this has not been confirmed. This BID will be updated if further information is released.
The Oracle HTTP Server mod_osso single sign-on module does not properly expire partner application cookies. This could present a security threat if a malicious user has a means to gain unauthorized access to partner application cookies. The expected behavior is that application cookies will expire.
This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. Oracle has not released any further information about this weakness. This issue could be related to vulnerability DB10 in the Critical Patch Update for July, though this has not been confirmed. This BID will be updated if further information is released.
Exploit / POC
Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
Solution:
This issue is addressed in the Oracle Critical Patch Update - July 2005.
Pre-installation notes for Oracle Database Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311062.1
Pre-installation notes for Oracle Application Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1
Solution:
This issue is addressed in the Oracle Critical Patch Update - July 2005.
Pre-installation notes for Oracle Database Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311062.1
Pre-installation notes for Oracle Application Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1
References
Oracle HTTP Server MOD_OSSO Partner Application Cookie Expiration Weakness
References:
References:
- Critical Patch Update - July 2005 (Oracle)
- Oracle CPU July 2005 - Silently fixed bugs (Red Database Security)