Signature Detail
Short Name |
HTTP:ORACLE:SOAP-CONF |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
HTTP |
Keywords |
Oracle Application Server SOAP Config File Access |
Release Date |
2006/10/20 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Oracle Application Server SOAP Config File Access
This signature detects attempts to exploit a known vulnerability against Oracle Application Server. In its default configuration, attackers can access the SOAP config file without authentication.
Extended Description
Security issues reportedly exist with Oracle's Simple Object Access Protocol (SOAP) implementation. It is possible for remote attackers to deploy and undeploy SOAP providers and services without valid credentials by default. Further compromise may occur if this vulnerability is exploited in conjunction with others.
Affected Products
- Oracle Oracle9i Application Server 1.0.2
References
- BugTraq: 4289
- CVE: CVE-2001-1371