Oct 30, 2002 : DoS Bug in Oracle9i Application Server
📅 - According to reports released on Tuesday, a potential security vulnerability, which could lead to denial of service attacks, has been detected in the Oracle9i Application Server by security consulting firm @stake.
In its security alert, @stake said the potential bug was discovered in the application server AS Web Cache admin module running on Windows. The company said denial of service scenarios could be triggered by issuing an HTTP GET request containing at least one dot-dot-slash in the URI, or by issuing a malformed GET request. @stake said both would create an exception, causing the service to fail.
Part of the company's Application Server suite, Oracle Web Cache is designed to operate in front of the Oracle Web server and act as a caching reverse proxy server.
Oracle confirmed the potential risk in a bulletin, recommending that users use firewall technology to restrict access to the Web Cache administration port. Oracle also urged users to use the tool's "Secure Subnets" feature to only allow access to administrators connecting from permitted IP addresses or subnets.
The company said it was monitoring the potential vulnerability, which would be fixed by default in the 9.0.4 release of Oracle91 Application Server.
In its security alert, @stake said the potential bug was discovered in the application server AS Web Cache admin module running on Windows. The company said denial of service scenarios could be triggered by issuing an HTTP GET request containing at least one dot-dot-slash in the URI, or by issuing a malformed GET request. @stake said both would create an exception, causing the service to fail.
Part of the company's Application Server suite, Oracle Web Cache is designed to operate in front of the Oracle Web server and act as a caching reverse proxy server.
Oracle confirmed the potential risk in a bulletin, recommending that users use firewall technology to restrict access to the Web Cache administration port. Oracle also urged users to use the tool's "Secure Subnets" feature to only allow access to administrators connecting from permitted IP addresses or subnets.
The company said it was monitoring the potential vulnerability, which would be fixed by default in the 9.0.4 release of Oracle91 Application Server.
Reads: 2081 | Category: General | Source: TheWHIR : Web Host Industry Reviews
URL source: http://www.thewhir.com/marketwatch/dos103002.cfm
Want to add a website news or press release ? Just do it, it's free! Use add web hosting news!
📅 -