National Vulnerability Database (CVE-2002-1632)

National Cyber-Alert System Vulnerability Summary: CVE-2002-1632
Orirignal release date: 2002-12-31 Source: US-CERT/NIST ### Overview Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2. ### Impact CVSS Severity: 6.7 (Medium) Range: remote Authentication: config Impact Type: conf,int ### Reference to Advisories, Solutions, and Tools External Source: MISC Name: http://www.nextgenss.com/papers/hpoas.pdf Hyperlink: http://www.nextgenss.com/papers/hpoas.pdf External Source: CONFIRM Name: http://www.kb.cert.org/vuls/id/SVIM-576QLZ Hyperlink: http://www.kb.cert.org/vuls/id/SVIM-576QLZ External Source: CONFIRM Name: http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf Hyperlink: http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf External Source: CERT-VN Name: VU#717827 Hyperlink: http://www.kb.cert.org/vuls/id/717827 External Source: BID Name: 6556 Hyperlink: http://www.securityfocus.com/bid/6556 External Source: XF Name: oracle-appserver-info-sample(8665) Hyperlink: http://xforce.iss.net/xforce/xfdb/8665 ### Vulnerable Software and Vendor Oracle9i Application Server (Oracle) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1632