RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
BID:33361
Info
RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
| Bugtraq ID: | 33361 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2009 12:00AM |
| Updated: | Jan 21 2009 10:52PM |
| Credit: | Eduardo Vela |
| Vulnerable: |
Oracle Oracle10g Application Server 10.1.3 .1.0 |
| Not Vulnerable: | |
Discussion
RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
Oracle Containers for J2EE is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
This issue is associated with Oracle security bug ID 7391479.
Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.
This issue affects Oracle Application Server 10g 10.1.3.1.0; other versions may also be affected.
UPDATE (January 21, 2009): This issue may be a duplicate of one of CVE-2008-4017 or CVE-2008-5460, resolved in the Oracle January 2009 Critical Patch Update. These issues are documented in BID 33177 (Oracle January 2009 Critical Patch Update Multiple Vulnerabilities). We will update this BID as more information becomes available.
NOTE: This BID is being retired because it is a duplicate of BID 30633 (Multiple Java Runtime Implementations UTF-8 Input Validation Vulnerability).
Oracle Containers for J2EE is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
This issue is associated with Oracle security bug ID 7391479.
Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.
This issue affects Oracle Application Server 10g 10.1.3.1.0; other versions may also be affected.
UPDATE (January 21, 2009): This issue may be a duplicate of one of CVE-2008-4017 or CVE-2008-5460, resolved in the Oracle January 2009 Critical Patch Update. These issues are documented in BID 33177 (Oracle January 2009 Critical Patch Update Multiple Vulnerabilities). We will update this BID as more information becomes available.
NOTE: This BID is being retired because it is a duplicate of BID 30633 (Multiple Java Runtime Implementations UTF-8 Input Validation Vulnerability).
Exploit / POC
RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
An attacker can exploit this issue via a browser. The following example URI is available:
http://www.example.com/web-app/foobar/%c0%ae%c0%ae/WEB-INF/web.xml
An attacker can exploit this issue via a browser. The following example URI is available:
http://www.example.com/web-app/foobar/%c0%ae%c0%ae/WEB-INF/web.xml
Solution / Fix
RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Oracle Application Server Oracle Containers for J2EE Directory Traversal Vulnerability
References:
References:
- Oracle Containers for J2EE Homepage (Oracle)
- Oracle Homepage (Oracle)
- Re: [Full-disclosure] Oracle Containers For Java Directory Traversal (OC4J) Orac (Eduardo Vela)
- Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server ("Eduardo Vela"
- Re: [Full-disclosure] Oracle Containers For Java Directory Traversal (OC4J) Orac (Mark Thomas