CVE-1999-1125: Critical severity oracle http server vulnerability
Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the setuid-root behavior so the webserver does not run with setuid root privileges (disable the setuid bit or configure the server to run without setuid root).
Oracle Webserver / Oracle HTTP Server 2.1 and earlier setuid root = disabled - Configuration
Change the owner of the server configuration file to root and tighten file permissions so the oracle account cannot modify the configuration file (prevent write access by unprivileged accounts).
Oracle Webserver / Oracle HTTP Server 2.1 and earlier - configuration file configuration file ownership and permissions = owned by root; not writable by oracle account
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1125?
CVE-1999-1125 is considered to be a critical vulnerability due to its potential for privilege escalation.
How do I fix CVE-1999-1125?
To fix CVE-1999-1125, ensure that the configuration file permissions are correctly set to prevent unauthorized access.
Who is affected by CVE-1999-1125?
CVE-1999-1125 affects users of Oracle Webserver versions 2.1 and earlier.
What can attackers do with CVE-1999-1125?
Attackers who gain access to the oracle account can modify the configuration file, leading to privilege escalation or arbitrary file changes.
Is there a patch available for CVE-1999-1125?
There are no specific patches mentioned for CVE-1999-1125 since it relates to configuration management rather than directly exploitable software vulnerabilities.