Hi everyone, Oracle have recently released a new Oracle security advisory on Oracle application server web cache. Details of the versions and platforms affected are available in Oracles advisory. This issue is reported as severity 1. For the issue to be exploited Web Cache must be running and listening on the web cache listener port. The type of HTTP server used does not matter. The vulnerable request must be sent to the web cache, if it is sent direct to the HTTP server this is cannot be exploited. There are no details of the actual vulnerability other than its a request to the web cache. Oracle say that the patches available from metalink should be applied and that there are no suitable work around. Please visit metalink for the patch, this is the link http://metalink.oracle.com/metalink/plsql/ml 2_documents.showDocument?p_database_id=NOT&p_id=265310.1 Oracle have not credited anyone with this discovery so it must be assumed to have been discovered internally or by contract staff. This is advisory #66 Details are available here http://www.petefinnigan.com/alerts.htm kind regards Pete -- Pete Finnigan email:pete@petefinnigan.com Web site: http://www.petefinnigan.com - Oracle security audit specialists Book:Oracle security step-by-step Guide - see http://store.sans.org for details.
