Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
BID:4292
Info
Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
| Bugtraq ID: | 4292 |
| Class: | Configuration Error |
| CVE: |
CVE-2002-0561 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 15 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Credited to David Litchfield. |
| Vulnerable: |
Stonesoft StoneBeat GUI 2.0 0.3 Stonesoft StoneBeat GUI 2.0 .0.3 Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 9.0 Oracle Oracle9i Application Server Web Cache 2.0 .0.3 Oracle Oracle9i Application Server Web Cache 2.0 .0.2 NT Oracle Oracle9i Application Server Web Cache 2.0 .0.2 Oracle Oracle9i Application Server Web Cache 2.0 .0.1 Oracle Oracle9i Application Server Web Cache 2.0 .0.0 Oracle Oracle9i Application Server 1.0.2 Oracle Oracle8i Standard Edition 8.1.7 .1 Oracle Oracle8i Standard Edition 8.1.7 |
| Not Vulnerable: | |
Discussion
Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
The Oracle 9iAS web service is powered by the Apache webserver. Included is an Apache module for PL/SQL support. Administrative web pages associated with this server allow a web user to modify Database Access Descriptors and cache settings.
By default, no authentication is required to access these administrative pages. As a result, any attacker able to access the page may perform these administrative functions. The ability to modify DAD settings may allow an attacker to access or modify PL/SQL applications, or deny service to legitimate users.
The Oracle 9iAS web service is powered by the Apache webserver. Included is an Apache module for PL/SQL support. Administrative web pages associated with this server allow a web user to modify Database Access Descriptors and cache settings.
By default, no authentication is required to access these administrative pages. As a result, any attacker able to access the page may perform these administrative functions. The ability to modify DAD settings may allow an attacker to access or modify PL/SQL applications, or deny service to legitimate users.