new security alert #66 issued in Oracle web cache

[Pete Finnigan <plsql () petefinnigan com>]

Hi everyone,

Oracle have recently released a new Oracle security advisory on Oracle
application server web cache. Details of the versions and platforms
affected are available in Oracles advisory. This issue is reported as
severity 1. 

For the issue to be exploited Web Cache must be running and listening on
the web cache listener port. The type of HTTP server used does not
matter. The vulnerable request must be sent to the web cache, if it is
sent direct to the HTTP server this is cannot be exploited. 

There are no details of the actual vulnerability other than its a
request to the web cache. 

Oracle say that the patches available from metalink should be applied
and that there are no suitable work around. Please visit metalink for
the patch, this is the link http://metalink.oracle.com/metalink/plsql/ml
2_documents.showDocument?p_database_id=NOT&p_id=265310.1 Oracle have not
credited anyone with this discovery so it must be assumed to have been
discovered internally or by contract staff. This is advisory #66

Details are available here http://www.petefinnigan.com/alerts.htm

kind regards

Pete
-- 
Pete Finnigan
email:pete () petefinnigan com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.