Nessus Plugin #11223

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Oracle 9iAS access to SOAP documentation

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2003 Javier Fernandez-Sanguino

Summary:

Tries to retrieve Oracle9iAS SOAP documentation

Version:

$Revision: 1.5 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

-

Description:

In a default installation of Oracle 9iAS, it is possible to
access SOAP documentation. These files might be useful for an attacker
to determine what application server is being used.

Solution:
Remove the 'soapdocs' alias from the Oracle 9iAS http.conf:
Alias /soapdocs/ $ORACLE_HOME/soap/docs/

Note that the default installation of Oracle 9iAS 1.0.2.2 does not
seem to suffer this issue.

More information:
http://otn.oracle.com/deploy/security/pdf/ias_soap_alert.pdf
http://www.cert.org/advisories/CA-2002-08.html

Also read:
Hackproofing Oracle Application Server from NGSSoftware:
available at http://www.nextgenss.com/papers/hpoas.pdf

Risk factor : Low