Signature Detail
Short Name |
DB:ORACLE:WEBCACHE-FILE-APPEND |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
DB |
Release Date |
2005/06/08 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+ |
DB: Oracle 9i Webcache File Appending
This signature detects attempts to exploit a known vulnerability in the Oracle 9i Webcache server. Unauthenticated attackers can send a malformed URL to overwrite arbitrary files on the server. Note: Patches are available.
Extended Description
Oracle Application Server 9i Webcache is prone to an arbitrary file corruption vulnerability. The issue exists becaue dangerous characters are not removed from a certain parameter value, allowing an attacker to construct a URI that contains an absolute path to any target file. If this URI is followed by a user with sufficient privileges, garbage data is appended to the end of the specified file.
Affected Products
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.0
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.1
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.2
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.2 NT
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.3
- Oracle Oracle9i Application Server Web Cache 2.0.0 .0.4
- Oracle Oracle9i Application Server Web Cache 9.0.2 .2
- Oracle Oracle9i Application Server Web Cache 9.0.2 .3
- Oracle Oracle9i Application Server Web Cache 9.0.3 .1
References