CVE-2002-1635: Medium severity Oracle Application Server vulnerability
Published Dec 31, 2002
·Updated
The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
Affected Software
1 affected component
Oracle Application Server
Event History
Dec 31, 2002
CVE Published
05:00 AM
Mar 28, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-1635?
CVE-2002-1635 is considered a moderate severity vulnerability.
2
How do I fix CVE-2002-1635?
To fix CVE-2002-1635, change the Location alias for the /perl directory to a ScriptAlias in the httpd.conf configuration file.
3
What systems are affected by CVE-2002-1635?
CVE-2002-1635 affects Oracle 9i Application Server (9iAS).
4
What kind of attacks can be executed due to CVE-2002-1635?
CVE-2002-1635 allows remote attackers to read the source code of arbitrary CGI files.
5
Is CVE-2002-1635 still relevant today?
CVE-2002-1635 may still be relevant for systems running unsupported versions of Oracle 9i Application Server.