Vulnerability Note VU#936507

Overview

Oracle 9i Application Server (9iAS) allows remote anonymous users to view source code in CGI scripts stored in the Apache cgi-bin. Attackers may analyze these scripts to discover usernames, passwords, or other proprietary data or methods.

Description

The default Apache configuration file in Oracle 9iAS provides a Location alias from "/perl" to "/cgi-bin". Because this alias is not defined as a ScriptAlias, documents accessed through the "/perl" alias are not interpreted as scripts should be. Instead, the server simply outputs the contents of the document.

Impact

Attackers may read the source code of CGI scripts by requesting them through the "/perl" alias. Attackers may analyze source code to discover usernames, passwords, or other proprietary data or methods.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Edit the "httpd.conf" file to change the "/perl" alias into a ScriptAlias.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Oracle	Affected	08 Feb 2002	26 Feb 2002

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.nextgenss.com/papers/hpoas.pdf
• http://otn.oracle.com/deploy/security/alerts.htm

Credit

Thanks to David Litchfield for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

• CVE IDs: Unknown
• Date Public: 10 Jan 2002
• Date First Published: 26 Feb 2002
• Date Last Updated: 05 Mar 2002
• Severity Metric: 11.25
• Document Revision: 8