Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
BID:6459
Info
Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
| Bugtraq ID: | 6459 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2002 12:00AM |
| Updated: | Dec 21 2002 12:00AM |
| Credit: | Vulnerability discovery credited to Matt Moore. |
| Vulnerable: |
Oracle Oracle9i Application Server 9.0.2 .0.0 Oracle Oracle9i Application Server 9.0.2 Oracle E-Business Suite 11i 11.8 Oracle E-Business Suite 11i 11.7 Oracle E-Business Suite 11i 11.6 Oracle E-Business Suite 11i 11.5 Oracle E-Business Suite 11i 11.4 Oracle E-Business Suite 11i 11.3 Oracle E-Business Suite 11i 11.2 Oracle E-Business Suite 11i 11.1 |
| Not Vulnerable: |
Oracle Oracle9i Application Server 9.0.2 .0.1 |
Discussion
Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
9i Application Server (9iAS) is the web application server infrastructure distributed by Oracle.
A vulnerability has been reported in 9iAS that results in information disclosure. Under some circumstances, it is possible to for a remote user to create a condition that results in the disclosure of Java Server Page source code. This could allow an attacker to gain access to information that could be used in a more directed attack.
9i Application Server (9iAS) is the web application server infrastructure distributed by Oracle.
A vulnerability has been reported in 9iAS that results in information disclosure. Under some circumstances, it is possible to for a remote user to create a condition that results in the disclosure of Java Server Page source code. This could allow an attacker to gain access to information that could be used in a more directed attack.
Exploit / POC
Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
Solution:
Oracle has stated that this vulnerability is fixed in Oracle 9i Application Server Release 2 version 9.0.2.0.1.
Oracle has also stated that versions of E-Business Suite 11i may be affected by this issue. See referenced advisory for additional information.
Oracle Oracle9i Application Server 9.0.2 .0.0
Oracle Oracle9i Application Server 9.0.2
Solution:
Oracle has stated that this vulnerability is fixed in Oracle 9i Application Server Release 2 version 9.0.2.0.1.
Oracle has also stated that versions of E-Business Suite 11i may be affected by this issue. See referenced advisory for additional information.
Oracle Oracle9i Application Server 9.0.2 .0.0
-
Oracle Oracle 9i Application Server Release 2 9.0.2.0.1
http://otn.oracle.com
Oracle Oracle9i Application Server 9.0.2
-
Oracle Oracle 9i Application Server Release 2 9.0.2.0.1
http://otn.oracle.com
References
Oracle 9i Application Server Java Server Page Source Code Disclosure Vulnerability
References:
References:
- Oracle Security Alert #47 version 5 (Oracle)