National Vulnerability Database (CVE-2001-1371)

National Cyber-Alert System Vulnerability Summary: CVE-2001-1371
Orirignal release date: 2002-02-06 Source: US-CERT/NIST ### Overview The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager. ### Impact CVSS Severity: 10 (High) Range: remote Authentication: config,race Impact Type: int,sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: The Aims Group Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: CERT Name: VU#736923 Hyperlink: http://www.kb.cert.org/vuls/id/736923 External Source: Security Focus Name: BID:4289 Hyperlink: http://www.securityfocus.com/bid/4289 External Source: CERT Name: CA-2002-08 Hyperlink: http://www.cert.org/advisories/CA-2002-08.html External Source: MISC Name: http://www.nextgenss.com/papers/hpoas.pdf Hyperlink: http://www.nextgenss.com/papers/hpoas.pdf External Source: CONFIRM Name: http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf Hyperlink: http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf ### Vulnerable Software and Vendor Oracle9i Application Server (Oracle) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1371