CVE-2002-0561

The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2002-07-03

Last modified

2024-08-08

Affected products

• Application Server (Oracle)
• Application Server Web Cache (Oracle)
• Oracle8i (Oracle)
• Oracle9i (Oracle)

References

• http://marc.info/?l=bugtraq&m=101301813117562&w=2
• http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
• http://www.cert.org/advisories/CA-2002-08.html
• http://www.kb.cert.org/vuls/id/611776
• http://www.nextgenss.com/papers/hpoas.pdf
• http://www.securityfocus.com/bid/4292