Oracle Webcache SSL Encryption Downgrade Weakness

Bugtraq ID:	14279
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 15 2005 12:00AM
Updated:	Jul 15 2005 12:00AM
Credit:	This issue was announced by Oracle.
Vulnerable:	Oracle Oracle9i Application Server Web Cache 9.0.2 .3
Not Vulnerable:

Oracle Webcache SSL Encryption Downgrade Weakness

A security weakness was reported in Oracle Webcache. The issue is that documents may be served with weaker SSL encryption than configured in Oracle HTTP Server.

This could result in a false sense of security.

This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. Oracle has not released any further information about this weakness.

Oracle Webcache SSL Encryption Downgrade Weakness

This issue could occur inadvertently and would not require an exploit as it cannot be actively exploited by an attacker.

Oracle Webcache SSL Encryption Downgrade Weakness

Solution:
This issue is addressed in the Oracle Critical Patch Update - July 2005.

Pre-installation notes for Oracle Database Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311062.1

Pre-installation notes for Oracle Application Server can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=311038.1

Oracle Webcache SSL Encryption Downgrade Weakness

References:

• Critical Patch Update - July 2005 (Oracle)
  
• Oracle CPU July 2005 - Silently fixed bugs (Red Database Security)