Vulnerability Note VU#977251

Oracle 9iAS XSQL Servlet ignores file permissions allowing arbitrary users to view sensitive configuration files

Original Release date: 06 Mar 2002 | Last revised: 06 Mar 2002

Overview

It is possible to read the sensitive configuration files from an Oracle 9i Application Server without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it.

Description

Default installation of the Oracle 9i Application Server does not set appropriate permissions to configuration files that contain sensitive information (see VU#476619). Since these files are not protected by default, any user can access the files directly through a virtual directory and view the contents. When these files have the appropriate permissions set, an HTTP request to access the files results in a "403 Forbidden" response. However, access can be gained by requesting the file using the XSQLServlet. This servlet will bypass any permissions placed on the file and display its content.

Impact

An intruder can read files that shouldn't be accessable, and gain sensitive information about the configuration of the server. This information can be used to compromise the server.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Apply the appropriate permissions to the configuration files and remove the XSQLServlet, if possible.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
OracleAffected13 Feb 200206 Mar 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Our thanks to David Litchfield of NGSSoftware, who reported on this vulnerability.

This document was written by Jason Rafail and is based on the report by David Litchfield.

Other Information

  • CVE IDs: Unknown
  • Date Public: 06 Feb 2002
  • Date First Published: 06 Mar 2002
  • Date Last Updated: 06 Mar 2002
  • Severity Metric: 22.50
  • Document Revision: 18

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.