CVE-1999-1068: Medium severity oracle http server vulnerability
Oracle Webserver 2.1, when serving PL/SQL stored procedures, allows remote attackers to cause a denial of service via a long HTTP GET request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the feature that serves PL/SQL stored procedures on the webserver to prevent exploitation via long HTTP GET requests.
Oracle Webserver 2.1 / Oracle HTTP Server PL/SQL stored procedure serving = disabled - Compensating control
Deploy perimeter protections (WAF, load balancer, or firewall) to block or limit excessively long HTTP GET requests and restrict access to PL/SQL-related endpoints to trusted IPs until a vendor fix is available.
- Operational
Monitor webserver logs for unusually long HTTP GET requests and signs of denial-of-service; apply request-rate limiting and request-size limits where possible and investigate/mitigate any observed service interruptions until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1068?
CVE-1999-1068 is considered a denial of service vulnerability due to its potential to disrupt service by creating long HTTP GET requests.
How do I fix CVE-1999-1068?
To mitigate CVE-1999-1068, consider upgrading to a more recent version of Oracle HTTP Server that is not vulnerable to this issue.
Which versions are affected by CVE-1999-1068?
CVE-1999-1068 affects Oracle Webserver 2.1.
What type of attack does CVE-1999-1068 facilitate?
CVE-1999-1068 facilitates a denial of service attack through excessive HTTP GET requests.
Is CVE-1999-1068 exploitable remotely?
Yes, CVE-1999-1068 can be exploited remotely by attackers to cause service disruption.