Guides DoS Bug Found in Oracle9i App Server

DoS Bug Found in Oracle9i App Server




Security consulting firm @stake has detected a potential vulnerability in the Oracle9i Application Server that could lead to denial of service (DoS) scenarios.

Security consulting firm @stake Tuesday discovered a vulnerability in the Oracle9i Application Server that could lead to denial of service scenarios.

In a security alert, @stake said the potential bug was discovered in the Oracle9i AS Web Cache admin module running on Windows. It said two different denial of service situations could be triggered by issuing an HTTP GET request containing at least one dot-dot-slash contained in the URI.

A second denial of service is triggered by issuing a malformed GET request, @stake said, warning that both scenarios would create an exception and the service will fail.

Oracle Web Cache is part of the company’s Application Server suite. It is designed to be implemented in front of the Oracle Web server and act as a caching reverse proxy server.

Oracle confirmed the potential security risk in a bulletin and urged users to “use firewall techniques to restrict access to the Web Cache administration port.”

Customers were also encouraged to use the “Secure Subnets” feature of the Web Cache Manager tool to provide access only to administrators connecting from a list of permitted IP addresses or subnets.

“The potential security vulnerability is being tracked internally at Oracle and will be fixed by default in the 9.0.4 release of Oracle9i Application Server,” the company said.

Latest Posts

Proxmox vs VMware Comparison

Proxmox virtual machines (VM) are highly popular with home server aficionados, whereas VMware sits squarely at the front of the enterprise VM market. Both...

What is Load Balancing?

Load balancing is a technique that ensures an organization's server does not get overloaded with traffic. With load balancing measures in place, workloads and...

Installing and Activating Hyper-V Linux Integration Services

Editor's Note: Updated to reflect changes with the Hyper-V Linux Integration Services 4.3 release. Microsoft developers have designed components that help in improving the performance of...

What is a Hypervisor Server?

At its most basic, a hypervisor is the “manager” of a software-hardware stack. The term “hypervisor” derives from the word “supervisor.” What is a Hypervisor? When...

HPE SimpliVity 380 Server Review

The HPE SimpliVity 380 Server was designed to deliver the high performance required by enterprise data centers in a simplified package. One of the...

Related Stories