search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Oracle Web Cache contains buffer overflow vulnerabilities

Vulnerability Note VU#291555

Original Release Date: 2002-06-04 | Last Revised: 2002-11-15

Overview

The CERT/CC is aware of a report about "several remotely exploitable buffer overflow vulnerabilities in the Oracle Web Cache Server" that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Web Cache process.

Description

The Oracle Web Cache acts as a reverse proxy, caching static and dynamic content generated from Oracle Application web servers. The CERT/CC is aware of a report of several buffer overflow vulnerabilities in the Oracle Web Cache. The report implies that the vulnerabilities exist in the Oracle Web Cache Manager, which is a web-based administration interface for the Oracle Web Cache. Further details about these vulnerabilities are not presently available, as the reporter (NGSSoftware) has intentionally released limited information in accordance with their disclosure policy. NGSSoftware reports that Oracle9iAS v1.0.2.2 for Windows NT/2000 was tested.

Impact

An unauthenticated remote attacker could execute arbitrary code or cause a denial of service on a vulnerable system. The Oracle Web Cache may run as SYSTEM on Windows NT and Windows 2000 systems.

Solution

Apply a Patch

When available, apply the appropriate patch. Oracle typically releases Security Alerts that include patch information.


Restrict Access

Where possible, limit access to vulnerable systems to trusted users, hosts, and networks. The report from NGSSoftware states that "In the interim Oracle customers can protect against this problem by ensuring that the administration pages for web cache have been protected by changing the default administrator password." This implies that the vulnerabilities may exist in the Oracle Web Cache Manager, a web-based management interface that listens for administration and configuration requests on port 4000/tcp by default. Oracle Web Cache also listens for cache invalidation requests on 4001/tcp and statistics monitoring requests on 4002/tcp.

The Oracle Technology Network (registration required) contains documentation on the Oracle Web Cache Manager, including instructions for changing the default administrator password, setting trusted administrative hosts and networks, changing the user and group IDs used by the Web Cache process on UNIX/Linux systems, and changing the default administration port.

Disable Unnecessary Services

If your site does not use the Oracle Web Cache, disable it.

Use Least Privilege

Run the Oracle Web Cache under a user account with the least privilege possible. Note that this workaround will not prevent exploitation, but may limit the impact of an attack.

Vendor Information

291555
 
Affected   Unknown   Unaffected

Oracle

Notified:  May 31, 2002 Updated:  June 18, 2002

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

NGSSoftware reports that Oracle9iAS v1.0.2.2 for Windows NT/2000 was tested.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

The CERT/CC thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion

Other Information

CVE IDs: None
Severity Metric: 7.00
Date Public: 2002-05-27
Date First Published: 2002-06-04
Date Last Updated: 2002-11-15 21:55 UTC
Document Revision: 26

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.