new security alert #66 issued in Oracle web cache

From: Pete Finnigan (plsql_at_petefinnigan.com)
Date: 03/16/04

  • Next message: Mark J Cox: "Re: Fw: Bilbao Method Exposed"
  • Next message: bugtraq_at_securityfocus.com: "Incoming message" 
    Date: Tue, 16 Mar 2004 13:25:49 +0000
To: BUGTRAQ@securityfocus.com

    Hi everyone,

    Oracle have recently released a new Oracle security advisory on Oracle
    application server web cache. Details of the versions and platforms
    affected are available in Oracles advisory. This issue is reported as
    severity 1.

    For the issue to be exploited Web Cache must be running and listening on
    the web cache listener port. The type of HTTP server used does not
    matter. The vulnerable request must be sent to the web cache, if it is
    sent direct to the HTTP server this is cannot be exploited.

    There are no details of the actual vulnerability other than its a
    request to the web cache.

    Oracle say that the patches available from metalink should be applied
    and that there are no suitable work around. Please visit metalink for
    the patch, this is the link http://metalink.oracle.com/metalink/plsql/ml
    2_documents.showDocument?p_database_id=NOT&p_id=265310.1 Oracle have not
    credited anyone with this discovery so it must be assumed to have been
    discovered internally or by contract staff. This is advisory #66

    Details are available here http://www.petefinnigan.com/alerts.htm

    kind regards

    Pete 

    -- 
Pete Finnigan
email:pete@petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.
  • Next message: Mark J Cox: "Re: Fw: Bilbao Method Exposed"
  • Next message: bugtraq_at_securityfocus.com: "Incoming message"