Vulnerability Note VU#476619

Overview

It is possible to read the "XSQLConfig.xml" and "soapConfig.xml" configuration files from an Oracle 9i Application Server under the default installation without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it.

Description

The XSQL configuration and SOAP configuration files contain sensitive information such as the database server host name, user ID's and passwords. Since these files are not protected by default, any user can access it directly through a virtual directory and view the contents.

Impact

An intruder can gain sensitive information about the configuration of the server. This information can be used to compromise the server.

Solution

Apply the appropriate permissions to these files, please see Oracle's Security Alert on this issue.

Apply the appropriate permissions to the "XSQLConfig.xml" and "soapConfig.xml" configuration files.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Oracle	Affected	13 Feb 2002	27 Feb 2002

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.nextgenss.com/papers/hpoas.pdf

Credit

Our thanks to David Litchfield of NGSSoftware, who reported on this vulnerability.

This document was written by Jason Rafail and is based on the report by David Litchfield.

Other Information

• CVE IDs: Unknown
• Date Public: 06 Feb 2002
• Date First Published: 06 Mar 2002
• Date Last Updated: 06 Mar 2002
• Severity Metric: 42.19
• Document Revision: 8