Vulnerability Note VU#278971
Oracle 9i Application Server does not adequately handle requests for nonexistent JSP files thereby disclosing web folder path information
Oracle 9i Application Servers (Oracle 9iAS) contain a default error page that can be used to find the physical path of files on the system.
Oracle 9iAS will display a default error page when a nonexistent ".jsp" file is specified. In the body of this page is the entire local path of the file on the server. This could pose privacy and security risks. An attacker could use this information to extrapolate the location of other files on the victim's machine, and use this information in conjunction with another vulnerability.
An intruder can gain sensitive information about a server's directory and file structure.
Upgrade to OJSP 220.127.116.11.0. Please note that free registration is required to access this page.
In Oracle's alert "Oracle Unintended JSP Execution Vulnerability" (pdf), Oracle recommends:
"Ensure that the virtual path in a URL is different from the actual directory path when using Oracle Apache/JServ. Also, do not use the <servletzonepath> directory in "ApJServMount <servletzonepath> <servletzone>" to store data or files."
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Oracle||Affected||08 Feb 2002||06 Mar 2002|
CVSS Metrics (Learn More)
Our thanks to KK Mookhey <firstname.lastname@example.org>, who discovered this vulnerability.
This document was written by Jason Rafail.
- CVE IDs: Unknown
- Date Public: 17 Sep 2001
- Date First Published: 06 Mar 2002
- Date Last Updated: 06 Mar 2002
- Severity Metric: 22.50
- Document Revision: 10
If you have feedback, comments, or additional information about this vulnerability, please send us email.