search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Oracle 9iAS creates temporary files when processing JSP requests that are world-readable

Vulnerability Note VU#547459

Original Release Date: 2002-02-27 | Last Revised: 2002-03-12


Oracle Database Server version 9iAS makes JSP source code publicly available. The source code may be used by attackers to analyze proprietary business logic or uncover Oracle's network configuration, usernames, and/or passwords.


When Oracle receives a request for JSP file, it compiles the file in a temporary directory under the "_pages" directory. The compilation of each JSP file results in a ".java" file, which contains Java bytecode and the original JSP source code. Since the "_pages" directory is publicly available over the Internet, any remote user can download the ".java" file and read the JSP source code.


An attacker may analyze JSP source code to determine Oracle usernames and passwords, database configuration, or other business logic that may be helpful for mounting more attacks.


The CERT/CC is currently unaware of a solution to this problem from the vendor.

The following workarounds were suggested by David Litchfield and have not been tested by CERT/CC.

Edit the httpd.conf file found in the $ORACLE_HOME$/apache/apache/conf directory.

To prevent access to the globals.jsa file add the following entry:

<Files ~ "^\globals.jsa">
    Order allow,deny
    Deny from all

To prevent access to the .java pages add the following entry:

<Location /_pages>
    Order deny,allow
    Deny from all

Note that if the JSP pages are stored in a aliased directory (i.e. not a subdirectory of "htdocs") then it is neccessary to add an entry of

<Location /dirname/_pages>
    Order deny,allow
    Deny from all

when "dirname" is the name of the aliased directory.

Vendor Information


Oracle Affected

Notified:  February 07, 2002 Updated: February 26, 2002



Vendor Statement

"Ok text. Please link to Alert #28 on"

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to David Litchfield for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

CVE IDs: None
Severity Metric: 11.25
Date Public: 2002-02-06
Date First Published: 2002-02-27
Date Last Updated: 2002-03-12 21:08 UTC
Document Revision: 11

Sponsored by CISA.