Security Update - Are you at risk?

07 Feb 2002

For a complete security audit please contact us - from £650.00 - £1,500.00

Title: SilverStream database structure
Category: CGI abuses
Summary: Checks if SilverStream database structure is visible.
Description:


An attacker may use this flaw to gain more knowledge about this host.

Risk factor : Medium
Solution : Reconfigure the server so that others cannot view database structure

 

Title: SilverStream directory listing
Category: CGI abuses
Summary: Checks if SilverStream directory listings are disabled.
Description:
SilverStream directory listings are enabled.
An attacker may use this problem to gain more knowledge on this server and possibly to get files you would want to hide.

Risk factor : Medium
Solution : Reconfigure the server so that others cannot view directory listings

Title: Oracle 9iAS mod_plsql directory traversal

Category: CGI abuses

Summary: Tests for Oracle9iAS mod_plsql directory traversal
Description: In a default installation of Oracle 9iAS, it is possible to use the mod_plsql module to perform a directory traversal attack.

Solution: Download the patch from the oracle metalink site.

References:
http://www.nextgenss.com/advisories/plsql.txt
http://www.oracle.com

Risk factor : High

 

Title: Oracle XSQLServlet XSQLConfig.xml File

Category: CGI abuses

Summary: Tests for presence of XSQLConfig.xml
Description: It is possible to read the contents of the XSQLConfig.xml file which contains
sensitive information.

Solution: Move this file to a safer location and update your servlet engine's configuration file to reflect the change.

Risk factor : High

 

Title: Oracle 9iAS mod_plsql cross site scripting

Category: CGI abuses

Summary: Tests for Oracle 9iAS mod_plsql cross site scripting

Description:The mod_plsql module supplied with Oracle9iAS allows cross site scripting attacks to be performed.

Solution: Patches which address several vulnerabilities in Oracle 9iAS can be downloaded from the oracle Metalink site.


Risk factor : High


Title: Oracle 9iAS Java Process Manager

Category: CGI abuses

Summary: Tests for Oracle9iAS Java Process Manager
Description: In a default installation of Oracle 9iAS, it is possible to access the Java Process Manager anonymously. Access to this page should be restricted.

Solution:Restrict access to /oprocmgr-status in httpd.conf

Risk factor : High

 

Title: Oracle 9iAS DAD Admin interface

Category: CGI abuses

Summary: Tests for presence of Oracle9iAS DAD Admin interface
Description:In a default installation of Oracle 9iAS, it is possible to access the
mod_plsql DAD Admin interface. Access to these pages should be restricted.

Solution:Edit the wdbsvr.app file, and change the setting 'administrators=' to
named users who are allowed admin privileges.

Risk factor : High


Title: Oracle 9iAS JSP Source File Reading

Category: CGI abuses

Summary: Test for Oracle 9iAS JSP Source File Reading
Description:In a default installation of Oracle 9iAS it is possible to read the source of
JSP files. When a JSP is requested it is compiled 'on the fly' and the
resulting HTML page is returned to the user. Oracle 9iAS uses a folder to hold
the intermediate files during compilation. These files are created in the same
folder in which the .JSP page resides. Hence, it is possible to access the
.java and compiled .class files for a given JSP page.

Solution: Edit httpd.conf to disallow access to the _pages folder.

Risk factor: Medium/High