| VID |
22185 |
| Severity |
40 |
| Port |
7777 |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
The Oracle9i Application Server PL/SQL Gateway web administration interface uses null authentication set by default.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module provides a web-based administration interface to configure Database Access Descriptors (DAD) and cache settings. A DAD describes how a PL/SQL request connects to an application and can specify credentials or other authentication information.
By default, no authentication is required to access these administrative pages. As a result, any attacker able to access the page may perform these administrative functions. The ability to modify DAD settings may allow an attacker to access or modify PL/SQL applications, or deny service to legitimate users. Also, access to the PL/SQL gateway administration web interface exposes two buffer overflow vulnerabilities: one in the DAD password field and a second in the cache directory name.
* References:
http://www.kb.cert.org/vuls/id/611776
http://www.kb.cert.org/vuls/id/659043
http://www.kb.cert.org/vuls/id/923395
http://www.cert.org/advisories/CA-2002-08.html
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://www.nextgenss.com/papers/hpoas.pdf
http://marc.theaimsgroup.com/?l=bugtraq&m=101301813117562&w=2
* Platforms Affected:
Oracle9i Application Server Any version |
| Recommendation |
1. Restrict Access
Access to the PL/SQL gateway administration web pages can be restricted by specifying authorized user names and connect strings or an administrative Database Access Descriptor (DAD) in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. For more information, read the section titled "Protecting the Administration pages" in the Oracle iAS documentation under "Using the PL/SQL Gateway".
2. Change Path to Administrative Interface
The path to the administration web pages can be configured in the the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. While changing the path may make it more difficult, it does not prevent an intruder from accessing the administration web pages. To protect the administration web pages, configure the PL/SQL gateway to require authentication as noted above under "Restrict Access".
3. Disable Vulnerable Service
Disable the PL/SQL service (modplsql or mod_plsql in Apache). |
| Related URL |
CVE-2002-0561 (CVE) |
| Related URL |
4292 (SecurityFocus) |
| Related URL |
8452 (ISS) |
|
