CVE-2002-0563: Medium severity Oracle Application Server vulnerability
The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0563?
CVE-2002-0563 is considered a critical vulnerability due to its ability to allow unauthorized access to sensitive services.
How do I fix CVE-2002-0563?
To fix CVE-2002-0563, configure the Oracle 9i Application Server to require authentication for sensitive services.
What systems are affected by CVE-2002-0563?
CVE-2002-0563 affects multiple Oracle 9i Application Server and Oracle Application Server Web Cache versions.
Can CVE-2002-0563 be exploited remotely?
Yes, CVE-2002-0563 can be exploited remotely by anonymous users.
Is there a workaround for CVE-2002-0563?
A potential workaround for CVE-2002-0563 is to restrict network access to the affected services.