Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
BID:14274
Info
Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
| Bugtraq ID: | 14274 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2003 12:00AM |
| Updated: | Feb 13 2003 12:00AM |
| Credit: | Discovery is credited to David Litchfield and Mark Litchfield of Next Generation Security Software. |
| Vulnerable: |
Oracle Oracle9i Application Server 9.0.2 .3 Oracle Oracle9i Application Server 9.0.2 |
| Not Vulnerable: |
Oracle Oracle9i Application Server 9.0.3 |
Discussion
Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
The mod_oradav module for Oracle HTTP Server included in Oracle9i Application Server is prone to a vulnerability. This is related to access controls on the '/dav_public' and '/dav_portal' directories, allowing a malicious user to fill up the directory. It is not known if this could have other security impacts.
This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. This issue was also addressed by Oracle Security Alert #52, dated Feb 13, 2003.
The mod_oradav module for Oracle HTTP Server included in Oracle9i Application Server is prone to a vulnerability. This is related to access controls on the '/dav_public' and '/dav_portal' directories, allowing a malicious user to fill up the directory. It is not known if this could have other security impacts.
This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. This issue was also addressed by Oracle Security Alert #52, dated Feb 13, 2003.
Exploit / POC
Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
There is no exploit required. The affected directories may be accessed through the following URIs:
http://www.example.com/dav_public
http://www.example.com/dav_portal
There is no exploit required. The affected directories may be accessed through the following URIs:
http://www.example.com/dav_public
http://www.example.com/dav_portal
Solution / Fix
Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
Solution:
This issue is addressed by Oracle9i Application Server 9.0.3.
The issue also appears to have been addressed in the Oracle Critical Patch Update - July 2005.
Pre-installation notes for Oracle Application Server related to the Critical Patch Update for July 2005 can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1
While this issue was addressed by the earlier Oracle Security Alert #52 advisory, users may wish to refer to the remedies provided by the Critical Path Update for July 2005 as these address a number of newly reported vulnerabilities.
Solution:
This issue is addressed by Oracle9i Application Server 9.0.3.
The issue also appears to have been addressed in the Oracle Critical Patch Update - July 2005.
Pre-installation notes for Oracle Application Server related to the Critical Patch Update for July 2005 can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1
While this issue was addressed by the earlier Oracle Security Alert #52 advisory, users may wish to refer to the remedies provided by the Critical Path Update for July 2005 as these address a number of newly reported vulnerabilities.
References
Oracle9i Application Server MOD_ORADAV Access Control Vulnerability
References:
References:
- Critical Patch Update - July 2005 (Oracle)
- Oracle CPU July 2005 - Silently fixed bugs (Red Database Security)
- Oracle Security Alert #52 (Oracle)
- Re: Silently fixed security bugs in Oracle Critical Patch Update July 2005 ("David Litchfield"