CVE-2002-0386

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a ".." (dot dot) sequence, or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://otn.oracle.com/deploy/security/pdf/2002alert43rev1.pdfPatch, Vendor Advisory
http://www.atstake.com/research/advisories/2002/a102802-1.txtExploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/10284.php
http://www.securityfocus.com/bid/5902
http://otn.oracle.com/deploy/security/pdf/2002alert43rev1.pdfPatch, Vendor Advisory
http://www.atstake.com/research/advisories/2002/a102802-1.txtExploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/10284.php
http://www.securityfocus.com/bid/5902

Timeline

Published: Nov 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-03877.5Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to ex CVE-2002-03887.5Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) CVE-2002-03892.1Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to re CVE-2002-03919.8Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including di CVE-2002-03927.5Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrar CVE-2002-039310.0Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and pos CVE-2002-039410.0Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing a CVE-2002-039510.0The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administra CVE-2002-03967.5The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows CVE-2002-03975.0Red-M 1050 (Bluetooth Access Point) publicizes its name, IP address, and other information in UDP packets to a broadcast address, which allo CVE-2002-039810.0Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a lo CVE-2002-03995.0Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary f