CVE

Id
4954  
CVE No.
CVE-2002-0563  
Status
Candidate  
Description
The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.  
Phase
Modified (20070207)  
Votes
ACCEPT(3) Alderson, Baker, Cole | MODIFY(1) Frech | NOOP(3) Cox, Foat, Wall  
Comments
Frech> XF:oracle-appserver-apache-services(8455)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
25484 4954 CVE-2002-0563 BUGTRAQ:20020206 Hackproofing Oracle Application Server paper  View
25485 4954 CVE-2002-0563 URL:http://marc.info/?l=bugtraq&m=101301813117562&w=2  View
25486 4954 CVE-2002-0563 MISC:http://www.appsecinc.com/Policy/PolicyCheck7024.html  View
25487 4954 CVE-2002-0563 CERT:CA-2002-08  View
25488 4954 CVE-2002-0563 URL:http://www.cert.org/advisories/CA-2002-08.html  View
25489 4954 CVE-2002-0563 CERT-VN:VU#168795  View
25490 4954 CVE-2002-0563 URL:http://www.kb.cert.org/vuls/id/168795  View
25491 4954 CVE-2002-0563 CONFIRM:http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf  View
25492 4954 CVE-2002-0563 MISC:http://www.nextgenss.com/papers/hpoas.pdf  View
25493 4954 CVE-2002-0563 BID:4293  View
25494 4954 CVE-2002-0563 URL:http://www.securityfocus.com/bid/4293  View
25495 4954 CVE-2002-0563 OSVDB:705  View
25496 4954 CVE-2002-0563 URL:http://www.osvdb.org/705  View
25497 4954 CVE-2002-0563 OSVDB:13152  View
25498 4954 CVE-2002-0563 URL:http://www.osvdb.org/13152  View
25499 4954 CVE-2002-0563 SECTRACK:1009167  View
25500 4954 CVE-2002-0563 URL:http://securitytracker.com/id?1009167  View
25501 4954 CVE-2002-0563 XF:oracle-appserver-apache-services(8455)  View

Related JVN