Nessus Plugin #10348

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

ows-bin

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2000 Noam Rathaus

Summary:

Checks if ows-bin is vulnerable

Version:

$Revision: 1.14 $

Cve_id:

CVE-2000-0169

Bugtraq_id:

1053

Xrefs:

-

Description:

Oracle's Web Listener (a component of the Oracle Application Server),
is installed and can be used by a remote attacker to run arbitrary
commands on the web server.

Read more about this hole at:
http://www.securiteam.com/windowsntfocus/Oracle_Web_Listener_4_0_x_CGI_vulnerability.html


Solution : If 'ows-bin' is the default CGI directory used by the Oracle Application Server Manager,
then remove the ows-bin virtual directory or point it to a more benign directory.
If 'ows-bin' is not the default then verify that there are no batch files in this directory.

Risk factor : High