search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Oracle 9i Application Server does not adequately handle requests for nonexistent JSP files thereby disclosing web folder path information

Vulnerability Note VU#278971

Original Release Date: 2002-03-06 | Last Revised: 2002-03-06

Overview

Oracle 9i Application Servers (Oracle 9iAS) contain a default error page that can be used to find the physical path of files on the system.

Description

Oracle 9iAS will display a default error page when a nonexistent ".jsp" file is specified. In the body of this page is the entire local path of the file on the server. This could pose privacy and security risks. An attacker could use this information to extrapolate the location of other files on the victim's machine, and use this information in conjunction with another vulnerability.

Impact

An intruder can gain sensitive information about a server's directory and file structure.

Solution

Upgrade to OJSP 1.1.2.0.0. Please note that free registration is required to access this page.

In Oracle's alert "Oracle Unintended JSP Execution Vulnerability" (pdf), Oracle recommends:

"Ensure that the virtual path in a URL is different from the actual directory path when using Oracle Apache/JServ. Also, do not use the <servletzonepath> directory in "ApJServMount <servletzonepath> <servletzone>" to store data or files."

Vendor Information

278971
 
Affected   Unknown   Unaffected

Oracle

Notified:  February 08, 2002 Updated:  March 06, 2002

Status

  Vulnerable

Vendor Statement

See http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Our thanks to KK Mookhey , who discovered this vulnerability.

This document was written by Jason Rafail.

Other Information

CVE IDs: None
Severity Metric: 22.50
Date Public: 2001-09-17
Date First Published: 2002-03-06
Date Last Updated: 2002-03-06 14:30 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.