bugtraq - new security alert #66 issued in Oracle web cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 16 Mar 2004 13:25:49 +0000
From: Pete Finnigan <plsql@...efinnigan.com>
To: BUGTRAQ@...urityfocus.com
Subject: new security alert #66 issued in Oracle web cache

Hi everyone,

Oracle have recently released a new Oracle security advisory on Oracle
application server web cache. Details of the versions and platforms
affected are available in Oracles advisory. This issue is reported as
severity 1. 

For the issue to be exploited Web Cache must be running and listening on
the web cache listener port. The type of HTTP server used does not
matter. The vulnerable request must be sent to the web cache, if it is
sent direct to the HTTP server this is cannot be exploited. 

There are no details of the actual vulnerability other than its a
request to the web cache. 

Oracle say that the patches available from metalink should be applied
and that there are no suitable work around. Please visit metalink for
the patch, this is the link http://metalink.oracle.com/metalink/plsql/ml
2_documents.showDocument?p_database_id=NOT&p_id=265310.1 Oracle have not
credited anyone with this discovery so it must be assumed to have been
discovered internally or by contract staff. This is advisory #66

Details are available here http://www.petefinnigan.com/alerts.htm

kind regards

Pete
-- 
Pete Finnigan
email:pete@...efinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.