CVE-2002-0563 The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2)...
MediumCVSS 5.0
EPSS 51.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle application server | = 1.0.2 | No fix listed |
| oracle application server web cache | = 2.0.0.0 | No fix listed |
| oracle application server web cache | = 2.0.0.1 | No fix listed |
| oracle application server web cache | = 2.0.0.2 | No fix listed |
| oracle application server web cache | = 2.0.0.3 | No fix listed |
| oracle8i | = 8.1.7 | No fix listed |
| oracle8i | = 8.1.7_.1 | No fix listed |
| oracle9i | = 9.0 | No fix listed |
| oracle9i | = 9.0.1 | No fix listed |
References
- 20020206 Hackproofing Oracle Application Server paper mailing-list
- otn.oracle.com patch vendor-advisory
- 1009167 vdb-entry
- www.appsecinc.com
- CA-2002-08 patch third-party-advisory us-government-resource
- VU#168795 third-party-advisory us-government-resource
- www.nextgenss.com
- 13152 vdb-entry
- 705 vdb-entry
- 4293 patch vdb-entry vendor-advisory
- oracle-appserver-apache-services(8455) vdb-entry