CVE-2001-0326: High severity Oracle Application Server vulnerability

Published May 3, 2001

Updated

Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.

Affected Software

2 affected components

Oracle Application Server=release_1.0.2.0.1

Oracle Oracle8i=8.1.7_r3

Remediation

Patch Available

http://archives.neohapsis.com/archives/bugtraq/2001-02/0255.html

Event History

May 3, 2001

CVE Published

04:00 AM

May 7, 2001

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-0326?

CVE-2001-0326 is considered a medium severity vulnerability due to its potential for unauthorized file access.

How do I fix CVE-2001-0326?

To fix CVE-2001-0326, reconfigure the server to restrict the use of <<ALL FILES>> FilePermission.

Who is affected by CVE-2001-0326?

CVE-2001-0326 affects users of Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1.

What types of attacks can exploit CVE-2001-0326?

CVE-2001-0326 can be exploited by remote attackers to read sensitive files on the server.

When was CVE-2001-0326 discovered?

CVE-2001-0326 was discovered in early 2001, highlighting a vulnerability in older versions of Oracle software.