Oracle 9i Default Configuration File Information Disclosure Vulnerability
BID:4290
Info
Oracle 9i Default Configuration File Information Disclosure Vulnerability
| Bugtraq ID: | 4290 |
| Class: | Configuration Error |
| CVE: |
CVE-2002-0568 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Credited to David Litchfield. |
| Vulnerable: |
Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 9.0 Oracle Oracle9i Application Server 1.0.2 Oracle Oracle8i Standard Edition 8.1.7 .1 Oracle Oracle8i Standard Edition 8.1.7 |
| Not Vulnerable: | |
Discussion
Oracle 9i Default Configuration File Information Disclosure Vulnerability
Oracle 9iAS includes two important configuration files called "XSQLConfig.xml" and "soapConfig.xml". The configuration files contain sensitive information, such as database usernames and passwords.
Both of these files are accessible to remote clients without any authentication. It is possible for malicious users to access and read the files through a virtual directory.
Possibly sensitive information disclosed to attackers may assist in further attacks.
Oracle 9iAS includes two important configuration files called "XSQLConfig.xml" and "soapConfig.xml". The configuration files contain sensitive information, such as database usernames and passwords.
Both of these files are accessible to remote clients without any authentication. It is possible for malicious users to access and read the files through a virtual directory.
Possibly sensitive information disclosed to attackers may assist in further attacks.
Exploit / POC
Oracle 9i Default Configuration File Information Disclosure Vulnerability
No exploit is required.
No exploit is required.
References
Oracle 9i Default Configuration File Information Disclosure Vulnerability
References:
References: