National Vulnerability Database (CVE-2002-0563)

National Cyber-Alert System Vulnerability Summary: CVE-2002-0563
Orirignal release date: 2002-07-03 Source: US-CERT/NIST ### Overview The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services. ### Impact CVSS Severity: 3.3 (Low) Range: remote Authentication: config Impact Type: conf ### Reference to Advisories, Solutions, and Tools External Source: The Aims Group Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: CERT Name: CERT Advisory CA-2002-08 Multiple Vulnerabilities in Oracle Servers Hyperlink: http://www.cert.org/advisories/CA-2002-08.html External Source: Oracle Name: http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1 Hyperlink: http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf adv=1 patch=1 External Source: Security Focus Name: bid 4293 Hyperlink: http://www.securityfocus.com/bid/4293 External Source: CERT-VN Name: VU#168795 Hyperlink: http://www.kb.cert.org/vuls/id/168795 External Source: MISC Name: http://www.nextgenss.com/papers/hpoas.pdf Hyperlink: http://www.nextgenss.com/papers/hpoas.pdf ### Vulnerable Software and Vendor Oracle8i (Oracle) Oracle9i Application Server (Oracle) Oracle9iAS Web Cache (Oracle) Oracle9i (Oracle) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0563