CVE-2002-0561

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101301813117562&w=2
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdfPatch, Vendor Advisory
http://www.cert.org/advisories/CA-2002-08.htmlUS Government Resource
http://www.kb.cert.org/vuls/id/611776Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4292Vendor Advisory
http://marc.info/?l=bugtraq&m=101301813117562&w=2
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdfPatch, Vendor Advisory
http://www.cert.org/advisories/CA-2002-08.htmlUS Government Resource
http://www.kb.cert.org/vuls/id/611776Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4292Vendor Advisory

Timeline

Published: Jul 3, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-05625.0The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which CVE-2002-05635.0The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authent CVE-2002-05647.5PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descr CVE-2002-05655.0Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attac CVE-2002-05665.0PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Aut CVE-2002-05677.5Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrar CVE-2002-05682.1Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information i CVE-2002-05697.5Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL CVE-2002-05702.1The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local us CVE-2002-05717.5Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.CVE-2002-05727.2FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by clo CVE-2002-05737.5Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code vi