BID:49633

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

Info

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

Bugtraq ID:	49633
Class:	Design Error
CVE:	CVE-2002-1635
Remote:	Yes
Local:	No
Published:	Feb 26 2002 12:00AM
Updated:	Feb 26 2002 12:00AM
Credit:	David Litchfield
Vulnerable:	Oracle Oracle9i Application Server - Compaq Tru64 5.1 - Compaq Tru64 5.0 f - Compaq Tru64 5.0 a - Compaq Tru64 5.0 - Compaq Tru64 4.0 g - HP HP-UX 11.11 - HP HP-UX 11.0 4 - HP HP-UX 11.0 - HP HP-UX 10.34 - HP HP-UX 10.30 - HP HP-UX 10.26 - HP HP-UX 10.20 - HP HP-UX 10.16 - HP HP-UX 10.10 - HP HP-UX 10.9 - HP HP-UX 10.8 - HP HP-UX 10.1 0 - HP HP-UX 10.0 1 - HP HP-UX 10.0 - HP HP-UX 9.10 - HP HP-UX 9.9 - HP HP-UX 9.8 - HP HP-UX 9.7 - HP HP-UX 9.6 - HP HP-UX 9.5 - HP HP-UX 9.4 - HP HP-UX 9.3 - HP HP-UX 9.1 - HP HP-UX 9.0 - HP HP-UX 8.9 - HP HP-UX 8.8 - HP HP-UX 8.7 - HP HP-UX 8.6 - HP HP-UX 8.5 - HP HP-UX 8.4 - HP HP-UX 8.2 - HP HP-UX 8.1 - HP HP-UX 8.0 - HP HP-UX 7.8 - HP HP-UX 7.6 - HP HP-UX 7.4 - HP HP-UX 7.2 - HP HP-UX 7.0 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - IBM AIX 4.1.5 - IBM AIX 4.1.4 - IBM AIX 4.1.3 - IBM AIX 4.1.2 - IBM AIX 4.1.1 - IBM AIX 4.1 - IBM AIX 4.0 - IBM AIX 3.2.5 - IBM AIX 3.2.4 - IBM AIX 3.2 - IBM AIX 3.1 - IBM AIX 3.0 x - IBM AIX 2.2.1 - IBM AIX 1.3 - IBM AIX 1.2.1 - IBM AIX 5.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Sun Solaris 2.5.1 _x86 - Sun Solaris 2.5.1 - Sun Solaris 1.1.4 -JL - Sun Solaris 1.1.4 - Sun Solaris 1.1.3 _U1 - Sun Solaris 1.1.3 - Sun Solaris 1.1.2 - Sun Solaris 1.1.1 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 - Sun Solaris 2.6_x86HW5/98 - Sun Solaris 2.6_x86HW3/98 - Sun Solaris 2.6_x86 - Sun Solaris 2.6 HW5/98 - Sun Solaris 2.6 HW3/98 - Sun Solaris 2.6 - Sun Solaris 2.5_x86 - Sun Solaris 2.5 - Sun Solaris 2.4_x86 - Sun Solaris 2.4 - Sun Solaris 2.3 - Sun Solaris 2.2 - Sun Solaris 2.1 - Sun Solaris 2.0 - Sun Solaris 1.2 - Sun Solaris 1.1

Not Vulnerable:

Discussion

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

Oracle Application Server 9i is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain sensitive information.

Exploit / POC

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

References

Oracle Application Server 9i 'httpd.conf' Information Disclosure Vulnerability

References:

Oracle Homepage (Oracle)
Oracle 9iAS allows access to CGI script source code within CGI-BIN directory (David Litchfield)
Oracle9i Application Server '/perl' alias could allow an attacker to view CGI so (David Litchfield)