Vulnerabilities > CVE-2002-0563 - Improper Authentication vulnerability in Oracle products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
oracle
CWE-287
nessus

Summary

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Utilizing REST's Trust in the System Resource to Register Man in the Middle
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.

Nessus

  • NASL familyWeb Servers
    NASL idORACLE_APPLICATION_SERVER_PCI.NASL
    descriptionThe remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities : - CVE-2000-0169: Remote command execution in the web listener component. - CVE-2000-1235: Information disclosure in the port listener component and modplsql. - CVE-2000-1236: SQL injection in mod_sql. - CVE-2001-0326: Information disclosure in the Java Virtual Machine. - CVE-2001-0419: Buffer overflow in ndwfn4.so. - CVE-2001-0591: Directory traversal. - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module. - CVE-2001-1217: Directory traversal vulnerability in the PL/SQL Apache module. - CVE-2001-1371: Improper access control in the SOAP service. - CVE-2001-1372: Information disclosure. - CVE-2002-0386: Denial of service through the administration module for Oracle Web Cache. - CVE-2002-0559: Buffer overflows in the PL/SQL module. - CVE-2002-0560: Information disclosure in the PL/SQL module. - CVE-2002-0561: Authentication bypass in the PL/SQL Gateway web administration interface. - CVE-2002-0562: Information disclosure through globals.jsa. - CVE-2002-0563: Improper access control on several services. - CVE-2002-0564: Authentication bypass in the PL/SQL module. - CVE-2002-0565: Information disclosure through JSP files in the _pages directory. - CVE-2002-0566: Denial of service in the PL/SQL module. - CVE-2002-0568: Improper access control on XSQLConfig.xml and soapConfig.xml. - CVE-2002-0569: Authentication bypass through XSQLServlet. - CVE-2002-0655: Denial of service in OpenSSL. - CVE-2002-0656: Buffer overflows in OpenSSL. - CVE-2002-0659: Denial of service in OpenSSL. - CVE-2002-0840: Cross-site scripting in the default error page of Apache. - CVE-2002-0842: Format string vulnerability in mod_dav. - CVE-2002-0843: Buffer overflows in ApacheBench. - CVE-2002-0947: Buffer overflow in rwcgi60. - CVE-2002-1089: Information disclosure in rwcgi60. - CVE-2002-1630: Improper access control on sendmail.jsp. - CVE-2002-1631: SQL injection in query.xsql. - CVE-2002-1632: Information disclosure through several JSP pages. - CVE-2002-1635: Information disclosure in Apache. - CVE-2002-1636: Cross-site scripting in the htp PL/SQL package. - CVE-2002-1637: Default credentials in multiple components. - CVE-2002-1858: Information disclosure through the WEB-INF directory. - CVE-2002-2153: Format string vulnerability in the administrative pages of the PL/SQL module. - CVE-2002-2345: Credential leakage in the web cache administrator interface. - CVE-2002-2347: Cross-site scripting in several JSP pages. - CVE-2004-1362: Authentication bypass in the PL/SQL module. - CVE-2004-1363: Buffer overflow in extproc. - CVE-2004-1364: Directory traversal in extproc. - CVE-2004-1365: Command execution in extproc. - CVE-2004-1366: Improper access control on emoms.properties. - CVE-2004-1367: Credential leakage in Database Server. - CVE-2004-1368: Arbitrary file execution in ISQL*Plus. - CVE-2004-1369: Denial of service in TNS Listener. - CVE-2004-1370: Multiple SQL injection vulnerabilities in PL/SQL. - CVE-2004-1371: Stack-based buffer overflow. - CVE-2004-1707: Privilege escalation in dbsnmp and nmo. - CVE-2004-1774: Buffer overflow in the MD2 package. - CVE-2004-1877: Phishing vulnerability in Single Sign-On component. - CVE-2004-2134: Weak cryptography for passwords in the toplink mapping workBench. - CVE-2004-2244: Denial of service in the XML parser. - CVE-2005-1383: Authentication bypass in HTTP Server. - CVE-2005-1495: Detection bypass. - CVE-2005-1496: Privilege escalation in the DBMS_Scheduler. - CVE-2005-2093: Web cache poisoning. - CVE-2005-3204: Cross-site scripting. - CVE-2005-3445: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2005-3446: Unspecified vulnerability in Internet Directory. - CVE-2005-3447: Unspecified vulnerability in Single Sign-On. - CVE-2005-3448: Unspecified vulnerability in the OC4J module. - CVE-2005-3449: Multiple unspecified vulnerabilities in multiple components. - CVE-2005-3450: Unspecified vulnerability in HTTP Server. - CVE-2005-3451: Unspecified vulnerability in SQL*ReportWriter. - CVE-2005-3452: Unspecified vulnerability in Web Cache. - CVE-2005-3453: Multiple unspecified vulnerabilities in Web Cache. - CVE-2006-0273: Unspecified vulnerability in the Portal component. - CVE-2006-0274: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0275: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0282: Unspecified vulnerability. - CVE-2006-0283: Unspecified vulnerability. - CVE-2006-0284: Multiple unspecified vulnerabilities. - CVE-2006-0285: Unspecified vulnerability in the Java Net component. - CVE-2006-0286: Unspecified vulnerability in HTTP Server. - CVE-2006-0287: Unspecified vulnerability in HTTP Server. - CVE-2006-0288: Multiple unspecified vulnerabilities in the Oracle Reports Developer component. - CVE-2006-0289: Multiple unspecified vulnerabilities. - CVE-2006-0290: Unspecified vulnerability in the Oracle Workflow Cartridge component. - CVE-2006-0291: Multiple unspecified vulnerabilities in the Oracle Workflow Cartridge component. - CVE-2006-0435: Unspecified vulnerability in Oracle PL/SQL. - CVE-2006-0552: Unspecified vulnerability in the Net Listener component. - CVE-2006-0586: Multiple SQL injection vulnerabilities. - CVE-2006-1884: Unspecified vulnerability in the Oracle Thesaurus Management System component. - CVE-2006-3706: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3707: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3708: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3709: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3710: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3711: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3712: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3713: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3714: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5353: Unspecified vulnerability in HTTP Server. - CVE-2006-5354: Unspecified vulnerability in HTTP Server. - CVE-2006-5355: Unspecified vulnerability in Single Sign-On. - CVE-2006-5356: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5357: Unspecified vulnerability in HTTP Server. - CVE-2006-5358: Unspecified vulnerability in the Oracle Forms component. - CVE-2006-5359: Multiple unspecified vulnerabilities in Oracle Reports Developer component. - CVE-2006-5360: Unspecified vulnerability in Oracle Forms component. - CVE-2006-5361: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5362: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5363: Unspecified vulnerability in Single Sign-On. - CVE-2006-5364: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5365: Unspecified vulnerability in Oracle Forms. - CVE-2006-5366: Multiple unspecified vulnerabilities. - CVE-2007-0222: Directory traversal vulnerability in EmChartBean. - CVE-2007-0275: Cross-site scripting vulnerability in Oracle Reports Web Cartridge (RWCGI60). - CVE-2007-0280: Buffer overflow in Oracle Notification Service. - CVE-2007-0281: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2007-0282: Unspecified vulnerability in OPMN02. - CVE-2007-0283: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0284: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-0285: Unspecified vulnerability in Oracle Reports Developer. - CVE-2007-0286: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0287: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0288: Unspecified vulnerability in Oracle Internet Directory. - CVE-2007-0289: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-1359: Improper access control in mod_security. - CVE-2007-1609: Cross-site scripting vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS). - CVE-2007-2119: Cross-site scripting vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. - CVE-2007-2120: Denial of service in the Oracle Discoverer servlet. - CVE-2007-2121: Unspecified vulnerability in the COREid Access component. - CVE-2007-2122: Unspecified vulnerability in the Wireless component. - CVE-2007-2123: Unspecified vulnerability in the Portal component. - CVE-2007-2124: Unspecified vulnerability in the Portal component. - CVE-2007-2130: Unspecified vulnerability in Workflow Cartridge. - CVE-2007-3553: Cross-site scripting vulnerability in Rapid Install Web Server. - CVE-2007-3854: Multiple unspecified vulnerabilities in the Advanced Queuing component and the Spatial component. - CVE-2007-3859: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-3861: Unspecified vulnerability in Oracle Jdeveloper. - CVE-2007-3862: Unspecified vulnerability in Single Sign-On. - CVE-2007-3863: Unspecified vulnerability in Oracle JDeveloper. - CVE-2007-5516: Unspecified vulnerability in the Oracle Process Mgmt & Notification component. - CVE-2007-5517: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5518: Unspecified vulnerability in HTTP Server. - CVE-2007-5519: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5520: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5521: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-5522: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5523: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5524: Unspecified vulnerability in Single Sign-On. - CVE-2007-5525: Unspecified vulnerability in Single Sign-On. - CVE-2007-5526: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5531: Unspecified vulnerability in Oracle Help for Web. - CVE-2008-0340: Multiple unspecified vulnerabilities in the Advanced Queuing component and Spatial component. - CVE-2008-0343: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0344: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0345: Unspecified vulnerability in the Core RDBMS component. - CVE-2008-0346: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-0347: Unspecified vulnerability in the Oracle Ultra Search component. - CVE-2008-0348: Multiple unspecified vulnerabilities in the PeopleTools component. - CVE-2008-0349: Unspecified vulnerability in the PeopleTools component. - CVE-2008-1812: Unspecified vulnerability in the Oracle Enterprise Manager component. - CVE-2008-1814: Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component. - CVE-2008-1823: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-1824: Unspecified vulnerability in the Oracle Dynamic Monitoring Service component. - CVE-2008-1825: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2583: Unspecified vulnerability in the sample Discussion Forum Portlet for the Oracle Portal component. - CVE-2008-2588: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-2589: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2593: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2594: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2595: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2008-2609: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2612: Unspecified vulnerability in the Hyperion BI Plus component. - CVE-2008-2614: Unspecified vulnerability in HTTP Server. - CVE-2008-2619: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2008-2623: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-3975: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3977: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3986: Unspecified vulnerability in the Oracle Discoverer Administrator component. - CVE-2008-3987: Unspecified vulnerability in the Oracle Discoverer Desktop component. - CVE-2008-4014: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2008-4017: Unspecified vulnerability in the OC4J component. - CVE-2008-5438: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-7233: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2009-0217: Signature spoofing vulnerability in multiple components. - CVE-2009-0989: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0990: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0994: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1008: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1009: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1010: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1011: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1017: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1976: Unspecified vulnerability in HTTP Server. - CVE-2009-1990: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-1999: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-3407: Unspecified vulnerability in the Portal component. - CVE-2009-3412: Unspecified vulnerability in the Unzip component. - CVE-2010-0066: Unspecified vulnerability in the Access Manager Identity Server component. - CVE-2010-0067: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2010-0070: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-0789: Unspecified vulnerability in HTTP Server. - CVE-2011-0795: Unspecified vulnerability in Single Sign-On. - CVE-2011-0884: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2011-2237: Unspecified vulnerability in the Oracle Web Services Manager component. - CVE-2011-2314: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-3523: Unspecified vulnerability in the Oracle Web Services Manager component.
    last seen2020-06-01
    modified2020-06-02
    plugin id57619
    published2012-01-24
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/57619
    titleOracle Application Server Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(57619);
      script_version("1.23");
      script_cvs_date("Date: 2019/04/05 15:04:42");
    
      script_cve_id(
        "CVE-2000-0169",
        "CVE-2000-1235",
        "CVE-2000-1236",
        "CVE-2001-0326",
        "CVE-2001-0419",
        "CVE-2001-0591",
        "CVE-2001-1216",
        "CVE-2001-1217",
        "CVE-2001-1371",
        "CVE-2001-1372",
        "CVE-2002-0386",
        "CVE-2002-0559",
        "CVE-2002-0560",
        "CVE-2002-0561",
        "CVE-2002-0562",
        "CVE-2002-0563",
        "CVE-2002-0564",
        "CVE-2002-0565",
        "CVE-2002-0566",
        "CVE-2002-0568",
        "CVE-2002-0569",
        "CVE-2002-0655",
        "CVE-2002-0656",
        "CVE-2002-0659",
        "CVE-2002-0840",
        "CVE-2002-0842",
        "CVE-2002-0843",
        "CVE-2002-0947",
        "CVE-2002-1089",
        "CVE-2002-1630",
        "CVE-2002-1631",
        "CVE-2002-1632",
        "CVE-2002-1635",
        "CVE-2002-1636",
        "CVE-2002-1637",
        "CVE-2002-1858",
        "CVE-2002-2153",
        "CVE-2002-2345",
        "CVE-2002-2347",
        "CVE-2004-1362",
        "CVE-2004-1363",
        "CVE-2004-1364",
        "CVE-2004-1365",
        "CVE-2004-1366",
        "CVE-2004-1367",
        "CVE-2004-1368",
        "CVE-2004-1369",
        "CVE-2004-1370",
        "CVE-2004-1371",
        "CVE-2004-1707",
        "CVE-2004-1774",
        "CVE-2004-1877",
        "CVE-2004-2134",
        "CVE-2004-2244",
        "CVE-2005-1383",
        "CVE-2005-1495",
        "CVE-2005-1496",
        "CVE-2005-2093",
        "CVE-2005-3204",
        "CVE-2005-3445",
        "CVE-2005-3446",
        "CVE-2005-3447",
        "CVE-2005-3448",
        "CVE-2005-3449",
        "CVE-2005-3450",
        "CVE-2005-3451",
        "CVE-2005-3452",
        "CVE-2005-3453",
        "CVE-2006-0273",
        "CVE-2006-0274",
        "CVE-2006-0275",
        "CVE-2006-0282",
        "CVE-2006-0283",
        "CVE-2006-0284",
        "CVE-2006-0285",
        "CVE-2006-0286",
        "CVE-2006-0287",
        "CVE-2006-0288",
        "CVE-2006-0289",
        "CVE-2006-0290",
        "CVE-2006-0291",
        "CVE-2006-0435",
        "CVE-2006-0552",
        "CVE-2006-0586",
        "CVE-2006-1884",
        "CVE-2006-3706",
        "CVE-2006-3707",
        "CVE-2006-3708",
        "CVE-2006-3709",
        "CVE-2006-3710",
        "CVE-2006-3711",
        "CVE-2006-3712",
        "CVE-2006-3713",
        "CVE-2006-3714",
        "CVE-2006-5353",
        "CVE-2006-5354",
        "CVE-2006-5355",
        "CVE-2006-5356",
        "CVE-2006-5357",
        "CVE-2006-5358",
        "CVE-2006-5359",
        "CVE-2006-5360",
        "CVE-2006-5361",
        "CVE-2006-5362",
        "CVE-2006-5363",
        "CVE-2006-5364",
        "CVE-2006-5365",
        "CVE-2006-5366",
        "CVE-2007-0222",
        "CVE-2007-0275",
        "CVE-2007-0280",
        "CVE-2007-0281",
        "CVE-2007-0282",
        "CVE-2007-0283",
        "CVE-2007-0284",
        "CVE-2007-0285",
        "CVE-2007-0286",
        "CVE-2007-0287",
        "CVE-2007-0288",
        "CVE-2007-0289",
        "CVE-2007-1359",
        "CVE-2007-1609",
        "CVE-2007-2119",
        "CVE-2007-2120",
        "CVE-2007-2121",
        "CVE-2007-2122",
        "CVE-2007-2123",
        "CVE-2007-2124",
        "CVE-2007-2130",
        "CVE-2007-3553",
        "CVE-2007-3854",
        "CVE-2007-3859",
        "CVE-2007-3861",
        "CVE-2007-3862",
        "CVE-2007-3863",
        "CVE-2007-5516",
        "CVE-2007-5517",
        "CVE-2007-5518",
        "CVE-2007-5519",
        "CVE-2007-5520",
        "CVE-2007-5521",
        "CVE-2007-5522",
        "CVE-2007-5523",
        "CVE-2007-5524",
        "CVE-2007-5525",
        "CVE-2007-5526",
        "CVE-2007-5531",
        "CVE-2008-0340",
        "CVE-2008-0343",
        "CVE-2008-0344",
        "CVE-2008-0345",
        "CVE-2008-0346",
        "CVE-2008-0347",
        "CVE-2008-0348",
        "CVE-2008-0349",
        "CVE-2008-1812",
        "CVE-2008-1814",
        "CVE-2008-1823",
        "CVE-2008-1824",
        "CVE-2008-1825",
        "CVE-2008-2583",
        "CVE-2008-2588",
        "CVE-2008-2589",
        "CVE-2008-2593",
        "CVE-2008-2594",
        "CVE-2008-2595",
        "CVE-2008-2609",
        "CVE-2008-2612",
        "CVE-2008-2614",
        "CVE-2008-2619",
        "CVE-2008-2623",
        "CVE-2008-3975",
        "CVE-2008-3977",
        "CVE-2008-3986",
        "CVE-2008-3987",
        "CVE-2008-4014",
        "CVE-2008-4017",
        "CVE-2008-5438",
        "CVE-2008-7233",
        "CVE-2009-0217",
        "CVE-2009-0989",
        "CVE-2009-0990",
        "CVE-2009-0994",
        "CVE-2009-1008",
        "CVE-2009-1009",
        "CVE-2009-1010",
        "CVE-2009-1011",
        "CVE-2009-1017",
        "CVE-2009-1976",
        "CVE-2009-1990",
        "CVE-2009-1999",
        "CVE-2009-3407",
        "CVE-2009-3412",
        "CVE-2010-0066",
        "CVE-2010-0067",
        "CVE-2010-0070",
        "CVE-2011-0789",
        "CVE-2011-0795",
        "CVE-2011-0884",
        "CVE-2011-2237",
        "CVE-2011-2314",
        "CVE-2011-3523"
      );
    
      script_bugtraq_id(
        1053,
        2150,
        2286,
        2569,
        3341,
        3726,
        3727,
        4032,
        4034,
        4037,
        4289,
        4290,
        4292,
        4293,
        4294,
        4298,
        4844,
        4848,
        5119,
        5262,
        5362,
        5363,
        5364,
        5366,
        5452,
        5847,
        5887,
        5902,
        5995,
        5996,
        6556,
        6846,
        7395,
        9515,
        9703,
        10009,
        10829,
        10871,
        13145,
        13418,
        13509,
        15034,
        15134,
        16287,
        16294,
        16384,
        17590,
        19054,
        20588,
        22027,
        22083,
        22831,
        23102,
        23532,
        24697,
        27229,
        33177,
        34461,
        35671,
        35688,
        36746,
        36749,
        36753,
        50202,
        50209
      );
    
      script_name(english:"Oracle Application Server Multiple Vulnerabilities");
      script_summary(english:"Checks version in Server response header.");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote web server may be affected by multiple vulnerabilities.");
     script_set_attribute(attribute:"description", value:
    "The remote host is running Oracle Application Server. It was not possible
    to determine its version, so the version of Oracle Application Server
    installed on the remote host could potentially be affected by multiple
    vulnerabilities :
    
      - CVE-2000-0169: Remote command execution in the web
        listener component.
    
      - CVE-2000-1235: Information disclosure in the port
        listener component and modplsql.
    
      - CVE-2000-1236: SQL injection in mod_sql.
    
      - CVE-2001-0326: Information disclosure in the Java
        Virtual Machine.
    
      - CVE-2001-0419: Buffer overflow in ndwfn4.so.
    
      - CVE-2001-0591: Directory traversal.
    
      - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.
    
      - CVE-2001-1217: Directory traversal vulnerability in the
        PL/SQL Apache module.
    
      - CVE-2001-1371: Improper access control in the SOAP
        service.
    
      - CVE-2001-1372: Information disclosure.
    
      - CVE-2002-0386: Denial of service through the
        administration module for Oracle Web Cache.
    
      - CVE-2002-0559: Buffer overflows in the PL/SQL module.
    
      - CVE-2002-0560: Information disclosure in the PL/SQL
        module.
    
      - CVE-2002-0561: Authentication bypass in the PL/SQL
        Gateway web administration interface.
    
      - CVE-2002-0562: Information disclosure through
        globals.jsa.
    
      - CVE-2002-0563: Improper access control on several
        services.
    
      - CVE-2002-0564: Authentication bypass in the PL/SQL
        module.
    
      - CVE-2002-0565: Information disclosure through JSP files
        in the _pages directory.
    
      - CVE-2002-0566: Denial of service in the PL/SQL module.
    
      - CVE-2002-0568: Improper access control on XSQLConfig.xml
        and soapConfig.xml.
    
      - CVE-2002-0569: Authentication bypass through
        XSQLServlet.
    
      - CVE-2002-0655: Denial of service in OpenSSL.
    
      - CVE-2002-0656: Buffer overflows in OpenSSL.
    
      - CVE-2002-0659: Denial of service in OpenSSL.
    
      - CVE-2002-0840: Cross-site scripting in the default error
        page of Apache.
    
      - CVE-2002-0842: Format string vulnerability in mod_dav.
    
      - CVE-2002-0843: Buffer overflows in ApacheBench.
    
      - CVE-2002-0947: Buffer overflow in rwcgi60.
    
      - CVE-2002-1089: Information disclosure in rwcgi60.
    
      - CVE-2002-1630: Improper access control on sendmail.jsp.
    
      - CVE-2002-1631: SQL injection in query.xsql.
    
      - CVE-2002-1632: Information disclosure through several
        JSP pages.
    
      - CVE-2002-1635: Information disclosure in Apache.
    
      - CVE-2002-1636: Cross-site scripting in the htp PL/SQL
        package.
    
      - CVE-2002-1637: Default credentials in multiple
        components.
    
      - CVE-2002-1858: Information disclosure through the
        WEB-INF directory.
    
      - CVE-2002-2153: Format string vulnerability in the
        administrative pages of the PL/SQL module.
    
      - CVE-2002-2345: Credential leakage in the web cache
        administrator interface.
    
      - CVE-2002-2347: Cross-site scripting in several JSP
        pages.
    
      - CVE-2004-1362: Authentication bypass in the PL/SQL
        module.
    
      - CVE-2004-1363: Buffer overflow in extproc.
    
      - CVE-2004-1364: Directory traversal in extproc.
    
      - CVE-2004-1365: Command execution in extproc.
    
      - CVE-2004-1366: Improper access control on
        emoms.properties.
    
      - CVE-2004-1367: Credential leakage in Database Server.
    
      - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.
    
      - CVE-2004-1369: Denial of service in TNS Listener.
    
      - CVE-2004-1370: Multiple SQL injection vulnerabilities in
        PL/SQL.
    
      - CVE-2004-1371: Stack-based buffer overflow.
    
      - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.
    
      - CVE-2004-1774: Buffer overflow in the MD2 package.
    
      - CVE-2004-1877: Phishing vulnerability in Single Sign-On
        component.
    
      - CVE-2004-2134: Weak cryptography for passwords in the
        toplink mapping workBench.
    
      - CVE-2004-2244: Denial of service in the XML parser.
    
      - CVE-2005-1383: Authentication bypass in HTTP Server.
    
      - CVE-2005-1495: Detection bypass.
    
      - CVE-2005-1496: Privilege escalation in the
        DBMS_Scheduler.
    
      - CVE-2005-2093: Web cache poisoning.
    
      - CVE-2005-3204: Cross-site scripting.
    
      - CVE-2005-3445: Multiple unspecified vulnerabilities in
        HTTP Server.
    
      - CVE-2005-3446: Unspecified vulnerability in Internet
        Directory.
    
      - CVE-2005-3447: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2005-3448: Unspecified vulnerability in the OC4J
        module.
    
      - CVE-2005-3449: Multiple unspecified vulnerabilities in
        multiple components.
    
      - CVE-2005-3450: Unspecified vulnerability in HTTP Server.
    
      - CVE-2005-3451: Unspecified vulnerability in
        SQL*ReportWriter.
    
      - CVE-2005-3452: Unspecified vulnerability in Web Cache.
    
      - CVE-2005-3453: Multiple unspecified vulnerabilities in
        Web Cache.
    
      - CVE-2006-0273: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2006-0274: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2006-0275: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2006-0282: Unspecified vulnerability.
    
      - CVE-2006-0283: Unspecified vulnerability.
    
      - CVE-2006-0284: Multiple unspecified vulnerabilities.
    
      - CVE-2006-0285: Unspecified vulnerability in the Java Net
        component.
    
      - CVE-2006-0286: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-0287: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-0288: Multiple unspecified vulnerabilities in
        the Oracle Reports Developer component.
    
      - CVE-2006-0289: Multiple unspecified vulnerabilities.
    
      - CVE-2006-0290: Unspecified vulnerability in the Oracle
        Workflow Cartridge component.
    
      - CVE-2006-0291: Multiple unspecified vulnerabilities in
        the Oracle Workflow Cartridge component.
    
      - CVE-2006-0435: Unspecified vulnerability in Oracle
        PL/SQL.
    
      - CVE-2006-0552: Unspecified vulnerability in the Net
        Listener component.
    
      - CVE-2006-0586: Multiple SQL injection vulnerabilities.
    
      - CVE-2006-1884: Unspecified vulnerability in the Oracle
        Thesaurus Management System component.
    
      - CVE-2006-3706: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3707: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3708: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3709: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3710: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3711: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3712: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3713: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3714: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5353: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5354: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5355: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2006-5356: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5357: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5358: Unspecified vulnerability in the Oracle
        Forms component.
    
      - CVE-2006-5359: Multiple unspecified vulnerabilities in
        Oracle Reports Developer component.
    
      - CVE-2006-5360: Unspecified vulnerability in Oracle Forms
        component.
    
      - CVE-2006-5361: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5362: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5363: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2006-5364: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5365: Unspecified vulnerability in Oracle
        Forms.
    
      - CVE-2006-5366: Multiple unspecified vulnerabilities.
    
      - CVE-2007-0222: Directory traversal vulnerability in
        EmChartBean.
    
      - CVE-2007-0275: Cross-site scripting vulnerability in
        Oracle Reports Web Cartridge (RWCGI60).
    
      - CVE-2007-0280: Buffer overflow in Oracle Notification
        Service.
    
      - CVE-2007-0281: Multiple unspecified vulnerabilities in
        HTTP Server.
    
      - CVE-2007-0282: Unspecified vulnerability in OPMN02.
    
      - CVE-2007-0283: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0284: Multiple unspecified vulnerabilities in
        Oracle Containers for J2EE.
    
      - CVE-2007-0285: Unspecified vulnerability in Oracle
        Reports Developer.
    
      - CVE-2007-0286: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0287: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0288: Unspecified vulnerability in Oracle
        Internet Directory.
    
      - CVE-2007-0289: Multiple unspecified vulnerabilities in
        Oracle Containers for J2EE.
    
      - CVE-2007-1359: Improper access control in mod_security.
    
      - CVE-2007-1609: Cross-site scripting vulnerability in
        servlet/Spy in Dynamic Monitoring Services (DMS).
    
      - CVE-2007-2119: Cross-site scripting vulnerability in the
        Administration Front End for Oracle Enterprise (Ultra)
        Search.
    
      - CVE-2007-2120: Denial of service in the Oracle
        Discoverer servlet.
    
      - CVE-2007-2121: Unspecified vulnerability in the COREid
        Access component.
    
      - CVE-2007-2122: Unspecified vulnerability in the Wireless
        component.
    
      - CVE-2007-2123: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2007-2124: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2007-2130: Unspecified vulnerability in Workflow
        Cartridge.
    
      - CVE-2007-3553: Cross-site scripting vulnerability in
        Rapid Install Web Server.
    
      - CVE-2007-3854: Multiple unspecified vulnerabilities in
        the Advanced Queuing component and the Spatial
        component.
    
      - CVE-2007-3859: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-3861: Unspecified vulnerability in Oracle
        Jdeveloper.
    
      - CVE-2007-3862: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-3863: Unspecified vulnerability in Oracle
        JDeveloper.
    
      - CVE-2007-5516: Unspecified vulnerability in the Oracle
        Process Mgmt & Notification component.
    
      - CVE-2007-5517: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5518: Unspecified vulnerability in HTTP Server.
    
      - CVE-2007-5519: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5520: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-5521: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-5522: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5523: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-5524: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-5525: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-5526: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5531: Unspecified vulnerability in Oracle Help
        for Web.
    
      - CVE-2008-0340: Multiple unspecified vulnerabilities in
        the Advanced Queuing component and Spatial component.
    
      - CVE-2008-0343: Unspecified vulnerability in the Oracle
        Spatial component.
    
      - CVE-2008-0344: Unspecified vulnerability in the Oracle
        Spatial component.
    
      - CVE-2008-0345: Unspecified vulnerability in the Core
        RDBMS component.
    
      - CVE-2008-0346: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2008-0347: Unspecified vulnerability in the Oracle
        Ultra Search component.
    
      - CVE-2008-0348: Multiple unspecified vulnerabilities in
        the PeopleTools component.
    
      - CVE-2008-0349: Unspecified vulnerability in the
        PeopleTools component.
    
      - CVE-2008-1812: Unspecified vulnerability in the Oracle
        Enterprise Manager component.
    
      - CVE-2008-1814: Unspecified vulnerability in the Oracle
        Secure Enterprise Search or Ultrasearch component.
    
      - CVE-2008-1823: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2008-1824: Unspecified vulnerability in the Oracle
        Dynamic Monitoring Service component.
    
      - CVE-2008-1825: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2583: Unspecified vulnerability in the sample
        Discussion Forum Portlet for the Oracle Portal
        component.
    
      - CVE-2008-2588: Unspecified vulnerability in the Oracle
        JDeveloper component.
    
      - CVE-2008-2589: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2593: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2594: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2595: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2008-2609: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2612: Unspecified vulnerability in the Hyperion
        BI Plus component.
    
      - CVE-2008-2614: Unspecified vulnerability in HTTP Server.
    
      - CVE-2008-2619: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2008-2623: Unspecified vulnerability in the Oracle
        JDeveloper component.
    
      - CVE-2008-3975: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-3977: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-3986: Unspecified vulnerability in the Oracle
        Discoverer Administrator component.
    
      - CVE-2008-3987: Unspecified vulnerability in the Oracle
        Discoverer Desktop component.
    
      - CVE-2008-4014: Unspecified vulnerability in the Oracle
        BPEL Process Manager component.
    
      - CVE-2008-4017: Unspecified vulnerability in the OC4J
        component.
    
      - CVE-2008-5438: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-7233: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2009-0217: Signature spoofing vulnerability in
        multiple components.
    
      - CVE-2009-0989: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-0990: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-0994: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-1008: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1009: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1010: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1011: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1017: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-1976: Unspecified vulnerability in HTTP Server.
    
      - CVE-2009-1990: Unspecified vulnerability in the Business
        Intelligence Enterprise Edition component.
    
      - CVE-2009-1999: Unspecified vulnerability in the Business
        Intelligence Enterprise Edition component.
    
      - CVE-2009-3407: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2009-3412: Unspecified vulnerability in the Unzip
        component.
    
      - CVE-2010-0066: Unspecified vulnerability in the Access
        Manager Identity Server component.
    
      - CVE-2010-0067: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2010-0070: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2011-0789: Unspecified vulnerability in HTTP Server.
    
      - CVE-2011-0795: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2011-0884: Unspecified vulnerability in the Oracle
        BPEL Process Manager component.
    
      - CVE-2011-2237: Unspecified vulnerability in the Oracle
        Web Services Manager component.
    
      - CVE-2011-2314: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2011-3523: Unspecified vulnerability in the Oracle
        Web Services Manager component.");
      script_set_attribute(attribute:"solution", value:
    "Verify that the version of Oracle Application Server installed is not
    affected by the listed vulnerabilities and/or filter incoming traffic to this port");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"manual");
      script_set_attribute(attribute:"cvss_score_rationale", value:"remote code execution");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploithub_sku", value:"EH-11-053");
      script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
      script_set_attribute(attribute:"d2_elliot_name", value:"Oracle Secure Backup 10.2.0.2 RCE (Windows)");
      script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(22, 79, 119, 200, 255, 264, 287);
      script_set_attribute(attribute:"vuln_publication_date", value:"2000/03/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/10/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/24");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Web Servers");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("find_service2.nasl");
      script_require_keys("Settings/PCI_DSS", "Settings/ParanoidReport");
      script_require_ports("Services/oracle_application_server");
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("http.inc");
    include("misc_func.inc");
    
    # Only PCI considers this an issue.
    if (!get_kb_item("Settings/PCI_DSS")) exit(0, "PCI-DSS compliance checking is not enabled.");
    
    # Make sure this is Oracle.
    port = get_kb_item_or_exit("Services/oracle_application_server");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    # We're flagging every installation of Oracle Application Server, with
    # every vulnerability it has ever had.
    security_hole(port);
    
  • NASL familyDatabases
    NASL idORACLE9I_JAVA_PROCESS_MANAGER.NASL
    descriptionThe remote host is an Oracle 9iAS server. By default, accessing the location /oprocmgr-status via HTTP lets an attacker obtain the list of processes running on the remote host, and even to to start or stop them.
    last seen2020-06-01
    modified2020-06-02
    plugin id10851
    published2002-02-07
    reporterThis script is Copyright (C) 2002-2018 Matt Moore
    sourcehttps://www.tenable.com/plugins/nessus/10851
    titleOracle 9iAS Java Process Manager /oprocmgr-status Anonymous Process Manipulation
    code
    #
    # This script was written by Matt Moore <[email protected]>
    #
    # Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>
    #      Erik Anderson <[email protected]>
    #      Added BugtraqID and CAN
    #
    # See the Nessus Scripts License for details
    #
    
    # Changes by Tenable:
    # - Revised plugin title (6/10/09)
    
    
    include("compat.inc");
    
    if(description)
    {
     script_id(10851);
     script_version("1.26");
    
     script_cve_id("CVE-2002-0563");
     script_bugtraq_id(4293);
    
     script_name(english:"Oracle 9iAS Java Process Manager /oprocmgr-status Anonymous Process Manipulation");
     
     script_set_attribute(attribute:"synopsis", value:
    "It is possible to obtain the list of Java processes running on the
    remote host anonymously, as well as to start and stop them." );
     script_set_attribute(attribute:"description", value:
    "The remote host is an Oracle 9iAS server. By default, accessing
    the location /oprocmgr-status via HTTP lets an attacker obtain
    the list of processes running on the remote host, and even to
    to start or stop them." );
     script_set_attribute(attribute:"solution", value:
    "Restrict access to /oprocmgr-status in httpd.conf" );
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
     script_cwe_id(287);
     # http://web.archive.org/web/20030407050036/http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
     script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?80fe4531");
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2002/02/07");
     script_set_attribute(attribute:"vuln_publication_date", value: "2002/02/06");
     script_set_attribute(attribute:"patch_publication_date", value: "2002/02/06");
     script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");
     script_set_attribute(attribute:"plugin_type", value:"remote");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server_web_cache");
     script_end_attributes();
    
     
     script_summary(english:"Tests for Oracle9iAS Java Process Manager");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2002-2020 Matt Moore");
     script_family(english:"Databases");
     script_dependencie("find_service1.nasl", "http_version.nasl");
     script_require_ports("Services/www", 80);
     script_require_keys("www/OracleApache");
     exit(0);
    }
    
    # Check starts here
    
    include("http_func.inc");
    include("global_settings.inc");
    
    port = get_http_port(default:80, embedded:TRUE);
    
    
    if(get_port_state(port))
    { 
    # Make a request for /oprocmgr-status
    
     req = http_get(item:"/oprocmgr-status", port:port);
     soc = http_open_socket(port);
     if(soc)
     {
     send(socket:soc, data:req);
     r = http_recv(socket:soc);
     http_close_socket(soc);
     if("Module Name" >< r)	
     	security_warning(port);
    
     }
    }
    
  • NASL familyDatabases
    NASL idORACLE9I_APACHE_DMS.NASL
    descriptionIn a default installation of Oracle 9iAS, it is possible to access the Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted.
    last seen2020-06-01
    modified2020-06-02
    plugin id10848
    published2002-02-07
    reporterThis script is Copyright (C) 2002-2018 Matt Moore
    sourcehttps://www.tenable.com/plugins/nessus/10848
    titleOracle 9iAS DMS / JPM Pages Anonymous Access
    code
    #
    # This script was written by Matt Moore <[email protected]>
    #
    # Script audit and contributions from Carmichael Security <http://www.carmichaelsecurity.com>
    #      Erik Anderson <[email protected]>
    #      Added BugtraqID and CAN
    #
    # See the Nessus Scripts License for details
    #
    
    # Changes by Tenable:
    # - Revised plugin title (6/9/09)
    
    
    include("compat.inc");
    
    if(description)
    {
     script_id(10848);
     script_version("1.24");
    
     script_cve_id("CVE-2002-0563");
     script_bugtraq_id(4293);
    
     script_name(english:"Oracle 9iAS DMS / JPM Pages Anonymous Access");
     
     script_set_attribute(attribute:"synopsis", value:
    "Sensitive resources can be accessed." );
     script_set_attribute(attribute:"description", value:
    "In a default installation of Oracle 9iAS, it is possible to access the 
    Dynamic Monitoring Services pages anonymously. Access to these pages 
    should be restricted." );
     script_set_attribute(attribute:"solution", value:
    "Edit httpd.conf to restrict access to /dms0." );
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
     script_cwe_id(287);
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2002/02/07");
     script_set_attribute(attribute:"vuln_publication_date", value: "2002/01/10");
     script_set_attribute(attribute:"patch_publication_date", value: "2002/02/06");
     script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");
     script_set_attribute(attribute:"plugin_type", value:"remote");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server_web_cache");
     script_end_attributes();
    
     
     script_summary(english:"Tests for presence of Oracle9iAS Dynamic Monitoring Services");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2002-2020 Matt Moore");
     script_family(english:"Databases");
     script_dependencie("find_service1.nasl", "http_version.nasl");
     script_require_ports("Services/www", 80);
     script_require_keys("www/OracleApache"); 
     exit(0);
    }
    
    # Check starts here
    
    include("http_func.inc");
    include("global_settings.inc");
    
    port = get_http_port(default:80, embedded:TRUE);
    
    if(get_port_state(port))
    { 
     req = http_get(item:"/dms0", port:port);	      
     soc = http_open_socket(port);
     if(soc)
     {
     send(socket:soc, data:req);
     r = http_recv(socket:soc);
     http_close_socket(soc);
     if("DMSDUMP version" >< r)	
     	security_warning(port);
    
     }
    }