Oracle Application Server Discloses XML Configuration Files to Remote Users
|
|
SecurityTracker Alert ID: 1009260 |
|
SecurityTracker URL: http://securitytracker.com/id/1009260
|
|
CVE Reference:
CAN-2002-0568
(Links to External Site)
|
Date: Feb 29 2004
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 1.0.2.x
|
Description:
Several configuration vulnerabilities were reported in the Oracle 9i Application Server. A remote user may be able to obtain sensitive configuration data.
In January 2002, NGSSoftware reported that a remote user can obtain the XSQL configuration file by requesting the following URL:
http://oracleserver/servlet/oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml
The file reportedly contains connection information including database server hostname, user IDs, and password.
It is also reported that a remote user can request the SOAP configuration file by requesting one of the following URLs:
http://oracleserver/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml
http://oracleserver/servlet/oracle.xml.xsql.XSQLServlet/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml
|
Impact:
A remote user can obtain potentially sensitive configuration files from the target server.
|
Solution:
CERT reports that the following Oracle advisory contains instructions for applying the appropriate security permissions to the 'XSQLConfig.xml' and 'soapConfig.xml' configuration files:
http://otn.oracle.com/deploy/security/pdf/ojvm_alert.pdf
|
Vendor URL: www.oracle.com/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 6 Feb 2002 06:43:59 -0000
Subject: Hackproofing Oracle Application Server paper
|
Howdy,
I've written a white-paper, "Hackproofing Oracle Application Server." It
covers vulnerable areas and what must done to secure the box. Anyone
interested may get a copy from http://www.nextgenss.com/papers/hpoas.pdf .
Cheers,
David Litchfield
http://www.nextgenss.com/
|
|
