Oracle Web Listener URL Character Substitution Vulnerability

Bugtraq ID:	841
Class:	Access Validation Error
CVE:	CVE-1999-1547
Remote:	Yes
Local:	Yes
Published:	Nov 25 1999 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Posted to Bugtraq by Mnemonix <[email protected]> on November 25, 1999.
Vulnerable:	Oracle Web Listener 2.1 for Solaris
Not Vulnerable:

Oracle Web Listener URL Character Substitution Vulnerability

Oracle's Web Listener, a combination webserver and web-database interface, has been shown to have a weakness whereby unauthorized users can gain access to restricted queries.

If a character in a URL is replaced with it's HTTP-escaped equivalent, the Web Listener will grant access without requiring authentication.


If an attacker requests (for example)
http: //target.host/ows/restricted.show
the Web Listener will request a userid and password.
However, if the attacker requests:
http: //target.host/ows/restricted%2eshow
the Web Listener will perform the action and display the results.

Oracle Web Listener URL Character Substitution Vulnerability

see discussion

Oracle Web Listener URL Character Substitution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Oracle Web Listener URL Character Substitution Vulnerability

References: