Oracle9iAS Web Cache Multiple Periods Denial Of Service Vulnerability

Bugtraq ID:	3762
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0102
Remote:	Yes
Local:	No
Published:	Dec 28 2001 12:00AM
Updated:	Jul 11 2009 09:56AM
Credit:	Discovery of this vulnerability is credited to Peter Grundl of KPMG. Initially publicized on December 28th, 2001 in an Oracle Security Alert.
Vulnerable:	Oracle Oracle9i Application Server Web Cache 2.0 .0.2 NT - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.2 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.1 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.0 - Oracle Oracle9i Application Server
Not Vulnerable:	Stonesoft StoneBeat GUI 2.0 .0.3 Oracle Oracle9i Application Server Web Cache 2.0 .0.3 - Oracle Oracle9i Application Server

Oracle9iAS Web Cache Multiple Periods Denial Of Service Vulnerability

Oracle9iAS Web Cache is a web caching solution for Oracle 9iAS Application Server, providing quick retrieval of dynamic web content.

It is possible for a remote attacker to cause a denial of service by making a request, via TCP port 4000, containing an excessive number of periods ('.'). This will cause the Web Cache admin service to shut down, requiring a manual restart to regain normal functionality.

Oracle9iAS Web Cache Multiple Periods Denial Of Service Vulnerability

There is no exploit code required.

Oracle9iAS Web Cache Multiple Periods Denial Of Service Vulnerability

Solution:
Oracle has released a fix in the 2.0.0.3 release of Oracle9iAS Web Cache. The patch number is 2131605 and is available from http://metalink.oracle.com.

Oracle9iAS Web Cache Multiple Periods Denial Of Service Vulnerability

References:

• Oracle Security Alert #27 (Oracle)
  
• Oracle Support Metalink (Oracle)