Oracle Application Server Discloses XML Configuration Files to Remote Users
|
|
SecurityTracker Alert ID: 1009260
|
|
CVE Reference: CAN-2002-0568
(Links to External Site)
|
Date: Feb 29 2004
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: NGSSoftware
|
Version(s): 1.0.2.x
|
Description: Several configuration vulnerabilities were reported in the Oracle 9i Application Server. A remote user may be able to obtain sensitive configuration data.
In January 2002, NGSSoftware reported that a remote user can obtain the XSQL configuration file by requesting the following URL:
http://oracleserver/servlet/oracle.xml.
xsql.XSQLServlet/xsql/lib/XSQLConfig.xml
The file reportedly contains connection information including database server hostname,
user IDs, and password.
It is also reported that a remote user can request the SOAP configuration file by requesting one of the
following URLs:
http://oracleserver/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml
http://oracleserver/servlet/oracle.xml.xsql.XSQLServlet/soapdocs/webapps/soa
p/WEB-INF/config/soapConfig.xml
|
Impact: A remote user can obtain potentially sensitive configuration files from the target server.
|
Solution: CERT reports that the following Oracle advisory contains instructions for applying the appropriate security permissions to the 'XSQLConfig.xml'
and 'soapConfig.xml' configuration files:
http://otn.oracle.com/deploy/security/pdf/ojvm_alert.pdf
|
Vendor URL: www.oracle.com/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000)
|
Reported By: "David Litchfield" <david@nextgenss.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 6 Feb 2002 06:43:59 -0000
From: "David Litchfield" <david@nextgenss.com>
Subject: Hackproofing Oracle Application Server paper
|
Howdy,
I've written a white-paper, "Hackproofing Oracle Application Server." It
covers vulnerable areas and what must done to secure the box. Anyone
interested may get a copy from http://www.nextgenss.com/papers/hpoas.pdf .
Cheers,
David Litchfield
http://www.nextgenss.com/
|
|
