Oracle9iAS Web Cache Null Character Denial Of Service Vulnerability

Bugtraq ID:	3760
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0102
Remote:	Yes
Local:	No
Published:	Dec 28 2001 12:00AM
Updated:	Jul 11 2009 09:56AM
Credit:	Discovery of this vulnerability is credited to Peter Grundl of KPMG. Initially publicized on December 28th, 2001 in an Oracle Security Alert.
Vulnerable:	Oracle Oracle9i Application Server Web Cache 2.0 .0.2 NT - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.2 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.1 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.0 - Oracle Oracle9i Application Server
Not Vulnerable:	Stonesoft StoneBeat GUI 2.0 .0.3 Oracle Oracle9i Application Server Web Cache 2.0 .0.3 - Oracle Oracle9i Application Server

Oracle9iAS Web Cache Null Character Denial Of Service Vulnerability

Oracle 9iAS Web Cache is unable to handle certain types of requests, making it prone to denial of service attacks.

It is possible for a remote attacker to cause a denial of service by making multiple malicious requests for the Web Cache service. Multiple maliciously constructed requests will cause the service to shutdown.

Oracle9iAS Web Cache Null Character Denial Of Service Vulnerability

There is no exploit code required.

Oracle9iAS Web Cache Null Character Denial Of Service Vulnerability

Solution:
Oracle has released a fix in the 2.0.0.3 release of Oracle9iAS Web Cache. The patch number is 2131605 and is available from http://metalink.oracle.com.

Oracle9iAS Web Cache Null Character Denial Of Service Vulnerability

References:

• Oracle Security Alert #27 (Oracle)
  
• Oracle Support Metalink (Oracle)