Oracle 9i Application Server Insecure Default File Permissions Vulnerability
BID:6460
Info
Oracle 9i Application Server Insecure Default File Permissions Vulnerability
| Bugtraq ID: | 6460 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 21 2002 12:00AM |
| Updated: | Dec 21 2002 12:00AM |
| Credit: | Vulnerability discovery credited to Matt Moore. |
| Vulnerable: |
Oracle Oracle9i Application Server 1.0.2 .2 Oracle E-Business Suite 11i 11.8 Oracle E-Business Suite 11i 11.7 Oracle E-Business Suite 11i 11.6 Oracle E-Business Suite 11i 11.5 Oracle E-Business Suite 11i 11.4 Oracle E-Business Suite 11i 11.3 Oracle E-Business Suite 11i 11.2 Oracle E-Business Suite 11i 11.1 |
| Not Vulnerable: |
Oracle Oracle9i Application Server 9.0.2 .0.1 |
Discussion
Oracle 9i Application Server Insecure Default File Permissions Vulnerability
9i Application Server (9iAS) is the web application server infrastructure distributed by Oracle.
It has been reported that Oracle 9iAS does not install with secure default permissions. The default installation of Oracle 9iAS allows users with local access to the system to access some contents of the 9iAS installation. A user with local access may also modify or remove files affected by this vulnerability. It should be noted that this only affects 9iAS installed on Microsoft Windows NT and 2000 systems.
9i Application Server (9iAS) is the web application server infrastructure distributed by Oracle.
It has been reported that Oracle 9iAS does not install with secure default permissions. The default installation of Oracle 9iAS allows users with local access to the system to access some contents of the 9iAS installation. A user with local access may also modify or remove files affected by this vulnerability. It should be noted that this only affects 9iAS installed on Microsoft Windows NT and 2000 systems.
Exploit / POC
Oracle 9i Application Server Insecure Default File Permissions Vulnerability
No exploit is required for this vulnerability.
No exploit is required for this vulnerability.
Solution / Fix
Oracle 9i Application Server Insecure Default File Permissions Vulnerability
Solution:
Oracle has stated that this vulnerability has been fixed in Oracle Application Server Release 2 9.0.2.0.1.
Oracle has also stated that versions of E-Business Suite 11i may be affected by this issue. See referenced advisory for additional information.
Oracle Oracle9i Application Server 1.0.2 .2
Solution:
Oracle has stated that this vulnerability has been fixed in Oracle Application Server Release 2 9.0.2.0.1.
Oracle has also stated that versions of E-Business Suite 11i may be affected by this issue. See referenced advisory for additional information.
Oracle Oracle9i Application Server 1.0.2 .2
-
Oracle Oracle 9i Application Server Release 2 9.0.2.0.1
http://otn.oracle.com
References
Oracle 9i Application Server Insecure Default File Permissions Vulnerability
References:
References:
- Oracle Security Alert #47 version 5 (Oracle)