How to remediate – Oracle 9iAS globals.jsa Database Credential Remote Disclosure

1. Introduction

Oracle 9iAS globals.jsa is a vulnerability where sensitive data may be disclosed on systems running Oracle 9i Application Server. This occurs because, by default, the server can return the globals.jsa file for web applications, which often contains database credentials. Successful exploitation could lead to unauthorised access to databases and compromise of confidential information. Systems affected are those running a default configuration of Oracle 9iAS. Impact is likely to be high on confidentiality, medium on integrity, and low on availability.

2. Technical Explanation

The vulnerability stems from the default configuration allowing access to the globals.jsa file via HTTP requests. An attacker can request this file directly and potentially retrieve database usernames, passwords, or other sensitive details used by web applications within Oracle 9iAS. The CVE associated with this issue is CVE-2002-0562.

• Root cause: Insecure default configuration allowing access to the globals.jsa file.
• Exploit mechanism: An attacker sends an HTTP request to retrieve the globals.jsa file for a specific web application hosted on the server. For example, http://example.com/application_name/globals.jsa.
• Scope: Oracle 9i Application Server (9iAS) is affected.

3. Detection and Assessment

• Quick checks: Use a web browser to attempt access to http:///application_name/globals.jsa, replacing and application_name with appropriate values.
• Scanning: Nessus plugin ID a1e12e40 can identify this vulnerability as an example.
• Logs and evidence: Examine web server access logs for requests to *.jsa files. Look for successful responses (status code 200) indicating file retrieval.

curl -I http://example.com/application_name/globals.jsa

4. Solution / Remediation Steps

The solution involves modifying the Apache configuration file to disallow access to *.jsa files, preventing attackers from retrieving sensitive information.

4.1 Preparation

• Ensure you have appropriate permissions to edit the httpd.conf file. A roll back plan is to restore the backed-up httpd.conf file.
• A change window may be required depending on your organisation’s policies, and approval from a system owner might be needed.

4.2 Implementation

1. Step 1: Open the httpd.conf file in a text editor. The location varies but is typically found within the Oracle 9iAS installation directory.
2. Step 2: Add the following line to disallow access to *.jsa files: Order deny,allow Deny from all.
3. Step 3: Save the httpd.conf file.
4. Step 4: Restart the Oracle 9i Application Server service for the changes to take effect.

4.3 Config or Code Example

Before

# No specific rules for .jsa files exist

After

 Order deny,allow Deny from all

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of vulnerability. Least privilege reduces the impact if exploited. Input validation prevents unsafe data being processed. Safe defaults minimise initial exposure.

• Practice 1: Implement least privilege principles, limiting access to sensitive files and directories.
• Practice 2: Regularly review default configurations for potential security weaknesses.

4.5 Automation (Optional)

Automation is not recommended due to the risk of service disruption if configuration errors occur. Manual verification is advised.

5. Verification / Validation

• Post-fix check: Use a web browser or curl to attempt access to http:///application_name/globals.jsa. Expect a 403 Forbidden response.
• Re-test: Re-run the quick check from Section 3; it should no longer return the globals.jsa file content.
• Monitoring: Monitor web server access logs for any attempts to access *.jsa files, which should now be blocked.

curl -I http://example.com/application_name/globals.jsa

6. Preventive Measures and Monitoring

Regular security baselines can prevent this issue by enforcing secure configurations. CI pipelines with SAST checks can identify insecure defaults. A sensible patch or config review cycle reduces risk.

• Baselines: Update your security baseline to include a rule requiring blocking access to *.jsa files.
• Pipelines: Implement Static Application Security Testing (SAST) in your CI pipeline to detect insecure default configurations.

7. Risks, Side Effects, and Roll Back

Incorrectly modifying the httpd.conf file could cause web applications to malfunction. A roll back plan is to restore the backed-up httpd.conf file.

• Roll back: Restore the original httpd.conf file from your backup and restart the Oracle 9i Application Server service.

8. References and Resources

• Vendor advisory or bulletin: https://www.oracle.com/index.html
• NVD or CVE entry: CVE-2002-0562
• Product or platform documentation relevant to the fix: N/A