1. Introduction
Oracle 9iAS mod_plsql DAD Admin Interface Access allows access to sensitive resources due to a default configuration issue. This can allow unauthorised users to view and potentially modify system settings, impacting the confidentiality of data and the integrity of the Oracle application server. Systems running a default installation of Oracle 9iAS are usually affected. A successful exploit could lead to information disclosure or denial of service.
2. Technical Explanation
In a standard Oracle 9iAS setup, the mod_plsql DAD Admin interface is accessible without proper restrictions. This means anyone who can reach the server can potentially access these administrative pages. The vulnerability is identified as CVE-2000-1235. An attacker could use a web browser to navigate directly to the admin interface and attempt to view or change settings.
- Root cause: Missing or weak access controls on the mod_plsql DAD Admin interface in default configurations.
- Exploit mechanism: An attacker sends an HTTP request to the vulnerable URL, bypassing authentication if no restrictions are in place. For example, accessing
http://example.com/pls/dadadmindirectly. - Scope: Oracle9i Application Server (9iAS) is affected.
3. Detection and Assessment
You can check for the vulnerability by attempting to access the DAD Admin interface directly. A thorough assessment involves reviewing the wdbsvr.app configuration file.
- Quick checks: Attempt to browse to
http://your_server/pls/dadadmin. If you are prompted for credentials, it is likely restricted. - Scanning: Nessus plugin ID 155881 may identify this vulnerability. This is an example only and should be verified.
- Logs and evidence: Check Oracle HTTP Server access logs for requests to the /pls/dadadmin directory. Look for successful accesses without proper authentication.
# No command available, direct URL test required.4. Solution / Remediation Steps
Restrict access to the mod_plsql DAD Admin interface by specifying allowed users in the wdbsvr.app file.
4.1 Preparation
- No dependencies are required, but ensure you have appropriate permissions to edit the configuration file. Change windows may be needed depending on your organisation’s policy.
4.2 Implementation
- Step 1: Open the wdbsvr.app file in a text editor. The location varies by installation, but is typically under /u01/app/oracle/product/
/http_server/admin/conf/. - Step 2: Locate the line starting with ‘administrators=’.
- Step 3: Change the value to a comma-separated list of usernames who are permitted admin access. For example, change ‘administrators=’ to ‘administrators=user1,user2’.
- Step 4: Save the wdbsvr.app file.
- Step 5: Restart the Oracle HTTP Server service for the changes to take effect.
4.3 Config or Code Example
Before
administrators= After
administrators=adminuser,securityteam 4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this issue.
- Practice 1: Least privilege – only grant admin access to users who absolutely require it.
- Practice 2: Secure defaults – configure systems with the most restrictive settings possible by default.
4.5 Automation (Optional)
No automation script is provided due to the specific nature of configuration file modification and potential installation differences.
5. Verification / Validation
Confirm the fix by attempting to access the DAD Admin interface with a user who should not have access. Verify that you are prompted for credentials, even if you provide valid admin credentials.
- Post-fix check: Attempt to browse to
http://your_server/pls/dadadminas a non-administrator user. You should be redirected to a login page or receive an access denied error. - Re-test: Repeat the initial detection method (browsing to /pls/dadadmin) and confirm that it now requires authentication.
- Monitoring: Check Oracle HTTP Server access logs for failed attempts to access /pls/dadadmin from unauthorized users.
# No command available, direct URL test required.6. Preventive Measures and Monitoring
Update security baselines and implement regular patch reviews.
- Baselines: Update your Oracle 9iAS security baseline to include this configuration change.
- Pipelines: Include checks in your deployment pipeline to verify the wdbsvr.app file is configured with restricted access.
- Asset and patch process: Review all Oracle systems regularly for missing patches or misconfigurations.
7. Risks, Side Effects, and Roll Back
Incorrectly configuring the wdbsvr.app file could prevent legitimate administrators from accessing the interface.
- Roll back: Restore the original wdbsvr.app file and restart the Oracle HTTP Server service.
8. References and Resources
Links to relevant resources.
- Vendor advisory or bulletin: No specific vendor advisory found for this configuration issue.
- NVD or CVE entry: CVE-2000-1235
- Product or platform documentation relevant to the fix: Oracle documentation on configuring mod_plsql DAD Admin interface.