CVE-2000-0169: High severity Oracle Application Server vulnerability
Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
oracle/java-system-application-server/ows-bin batch filesfrom your environment.Remove or rename batch files in the ows-bin directory so they cannot be invoked by the web listener.
- Configuration
Disable execution of batch (.bat) files or CGI handlers in the ows-bin directory via the web listener configuration (prevent .bat from being executed by the web server).
Oracle web listener (ows-bin) batch/CGI execution = disabled - Compensating control
Restrict access to the web listener and the ows-bin directory to trusted IP addresses only (use firewall rules, ACLs, or a WAF) to block external access to the vulnerable endpoints.
- Operational
Review web server and application logs for requests containing the sequence '?&' and for any signs of unexpected command execution; investigate any suspicious activity and remediate any compromise found.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0169?
CVE-2000-0169 is a critical vulnerability that allows remote command execution.
How do I fix CVE-2000-0169?
To fix CVE-2000-0169, it's recommended to upgrade to a patched version of Oracle Application Server.
What versions of Oracle are affected by CVE-2000-0169?
CVE-2000-0169 specifically affects Oracle Application Server version 4.0.
Can CVE-2000-0169 be exploited remotely?
Yes, CVE-2000-0169 can be exploited remotely through specially crafted URLs.
What type of attacks can CVE-2000-0169 facilitate?
CVE-2000-0169 can facilitate unauthorized command execution on the affected systems.