search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Oracle 9iAS default configuration allows arbitrary users to view sensitive configuration files

Vulnerability Note VU#476619

Original Release Date: 2002-03-06 | Last Revised: 2002-03-06

Overview

It is possible to read the "XSQLConfig.xml" and "soapConfig.xml" configuration files from an Oracle 9i Application Server under the default installation without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it.

Description

The XSQL configuration and SOAP configuration files contain sensitive information such as the database server host name, user ID's and passwords. Since these files are not protected by default, any user can access it directly through a virtual directory and view the contents.

Impact

An intruder can gain sensitive information about the configuration of the server. This information can be used to compromise the server.

Solution

Apply the appropriate permissions to these files, please see Oracle's Security Alert on this issue.

Apply the appropriate permissions to the "XSQLConfig.xml" and "soapConfig.xml" configuration files.

Vendor Information

476619
 
Affected   Unknown   Unaffected

Oracle

Notified:  February 13, 2002 Updated:  February 27, 2002

Status

  Vulnerable

Vendor Statement

Please see Oracle's Security Alert at http://otn.oracle.com/deploy/security/pdf/ojvm_alert.pdf.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Our thanks to David Litchfield of NGSSoftware, who reported on this vulnerability.

This document was written by Jason Rafail and is based on the report by David Litchfield.

Other Information

CVE IDs: None
Severity Metric: 42.19
Date Public: 2002-02-06
Date First Published: 2002-03-06
Date Last Updated: 2002-03-06 14:17 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.