Vulnerability Note VU#758483
Oracle9i Application Server Apache PL/SQL module does not properly decode URL
A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS) in which the module does not properly decode double URL encoded strings. This vulnerability could allow an intruder to read files outside the web server's root directory.
NGSSoftware has released Insight Security Research Advisory #NISR20122001 describing two vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). The second of these vulnerabilities, improper URL decoding, is discussed in this document.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module also provides the ability to remotely administer the Database Access Descriptors (DAD) and access help pages. While access to the DADs is restricted by username and password, access to the help pages is not and they can be accessed by any user.
An unauthenticated remote intruder could read files outside the root of the web server with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an intruder may be able to read any file on the system that can be displayed in a web browser.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Oracle||Affected||-||12 Mar 2002|
CVSS Metrics (Learn More)
This document was written by Art Manion.
- CVE IDs: CAN-2001-1217
- Date Public: 13 Dec 2001
- Date First Published: 09 Jan 2002
- Date Last Updated: 15 Mar 2002
- Severity Metric: 3.99
- Document Revision: 28
If you have feedback, comments, or additional information about this vulnerability, please send us email.