Oracle Oracle9iAS Web Cache HTTP Header DoS Vulnerability

Bugtraq ID:	3765
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 10 2001 12:00AM
Updated:	Oct 10 2001 12:00AM
Credit:	Discovered by George Hedfors <[email protected]> and Andreas Junestam <[email protected]> of Defcom Labs and published in Oracle Security Alert #27.
Vulnerable:	Oracle Oracle9i Application Server Web Cache 2.0 .0.2 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.1 - Oracle Oracle9i Application Server Oracle Oracle9i Application Server Web Cache 2.0 .0.0 - Oracle Oracle9i Application Server
Not Vulnerable:	Oracle Oracle9i Application Server Web Cache 2.0 .0.3 - Oracle Oracle9i Application Server

Oracle Oracle9iAS Web Cache HTTP Header DoS Vulnerability

Oracle9iAS Web Cache is a web caching solution for Oracle 9iAS Application Server, providing quick retrieval of dynamic web content.

A remote attacker may cause a denial of service attack on Oracle9iAS by sending a request with an unusual number of characters in the HTTP header. This has the potential to deny service to legitimate users.

A manual restart of the service is required to resume normal functionality.

Oracle Oracle9iAS Web Cache HTTP Header DoS Vulnerability

No exploit required.

Oracle Oracle9iAS Web Cache HTTP Header DoS Vulnerability

Solution:
Oracle has released a fix in the 2.0.0.3 release of Oracle9iAS Web Cache. The patch number is 2131605 and is available from http://metalink.oracle.com.

Oracle Oracle9iAS Web Cache HTTP Header DoS Vulnerability

References:

• Oracle Security Alert #27 (Oracle)
  
• Oracle Support Metalink (Oracle)