search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Oracle 9iAS allows access to CGI script source code within CGI-BIN directory

Vulnerability Note VU#936507

Original Release Date: 2002-02-27 | Last Revised: 2002-03-05

Overview

Oracle 9i Application Server (9iAS) allows remote anonymous users to view source code in CGI scripts stored in the Apache cgi-bin. Attackers may analyze these scripts to discover usernames, passwords, or other proprietary data or methods.

Description

The default Apache configuration file in Oracle 9iAS provides a Location alias from "/perl" to "/cgi-bin". Because this alias is not defined as a ScriptAlias, documents accessed through the "/perl" alias are not interpreted as scripts should be. Instead, the server simply outputs the contents of the document.

Impact

Attackers may read the source code of CGI scripts by requesting them through the "/perl" alias. Attackers may analyze source code to discover usernames, passwords, or other proprietary data or methods.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Edit the "httpd.conf" file to change the "/perl" alias into a ScriptAlias.

Vendor Information

936507
Expand all

Oracle

Notified:  February 08, 2002 Updated:  February 26, 2002

Status

  Vulnerable

Vendor Statement

"The info provided below is correct: see Oracle Alert #28 at http://otn.oracle.com/deploy/security/alerts.htm."

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Thanks to David Litchfield for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

CVE IDs: None
Severity Metric: 11.25
Date Public: 2002-01-10
Date First Published: 2002-02-27
Date Last Updated: 2002-03-05 22:28 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.