Unscored severity · published Mar 25, 2002
CVE-2002-0103
An installer program for Oracle9iAS Web Cache 2.0.0.x creates executable and configuration files with insecure permissions, which allows local users to gain privileges by (1)…
–
CVSS
0.6%
EPSS
No
On KEV
Description
An installer program for Oracle9iAS Web Cache 2.0.0.x creates executable and configuration files with insecure permissions, which allows local users to gain privileges by (1) running webcached or (2) obtaining the administrator password from webcache.xml.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Application Server Web Cache · Oracle
2.0.0.0; 2.0.0.1; 2.0.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0103
marc.info
http://marc.info/?l=bugtraq&m=101041510727937&w=2
Patch
http://otn.oracle.com/deploy/security/pdf/webcache2.pdf
www.iss.net
http://www.iss.net/security_center/static/7766.php
www.iss.net
http://www.iss.net/security_center/static/7768.php
www.securityfocus.com
http://www.securityfocus.com/bid/3761
www.securityfocus.com
http://www.securityfocus.com/bid/3764
More from Application Server Web Cache
–
CVE-2005-1382
The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter
–
CVE-2005-1381
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2)…
–
CVE-2004-0385
Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long…
–
CVE-2002-0561
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to…
–
CVE-2002-0562
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain…