|
|
Family: Databases --> Category: infos
Oracle 9iAS access to SOAP documentation Vulnerability Scan
Vulnerability Scan Summary
Tries to retrieve Oracle9iAS SOAP documentation
Detailed Explanation for this Vulnerability Test
In a default installation of Oracle 9iAS, it is possible to
access SOAP documentation. These files might be useful for a possible hacker
to acertain what application server is being used.
Solution:
Remove the 'soapdocs' alias from the Oracle 9iAS http.conf:
Alias /soapdocs/ $ORACLE_HOME/soap/docs/
Note that the default installation of Oracle 9iAS 1.0.2.2 does not
seem to suffer this issue.
More information:
http://otn.oracle.com/deploy/security/pdf/ias_soap_alert.pdf
http://www.cert.org/advisories/CA-2002-08.html
Also read:
Hackproofing Oracle Application Server from NGSSoftware:
available at http://www.nextgenss.com/papers/hpoas.pdf
Threat Level: Low
Click HERE for more information and discussions on this network vulnerability scan.
|
