Red-Database-Security GmbH Research Advisory

Name Webcache Client Requests Bypass OHS mod_access Restrictions
Systems Affected Oracle HTTP Server
Severity Medium Risk
Category Bypass protected URLs via Webcache
Vendor URL http://www.oracle.com
Author Alexander Kornbrust (ak at red-database-security.com)
Date 26 Apr 2005 (V 1.00)
Advisory number AKSEC2003-015

Description
###########
Without the parameter "UseWebcacheIP ON" it is possible to bypass Oracle HTTP Server
mod_access restrictions.

More details available:
#######################

http://www.red-database-security.com/advisory/oracle_webcache_bypass.htm
l

Patch Information
#################
Add the new parameter "UseWebCacheIP ON" to the httpd.conf

History:
########
01 October 2003 Oracle secalert was informed
23 October 2003 Bug confirmed
26 April 2005 Advisory released

About Red-Database-Security GmbH
#################################
Red-Database-Security GmbH is a specialist in Oracle Security.

http://www.red-database-security.com

[ reply ]