NetSight
IP …
high7.5

CVE-2004-1362

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversion…

Impact

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.

Affected products

VendorProductAffected versions
OracleApplication Server
All versions
Versions 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2
OracleCollaboration Suite
Version release_1
OracleE-Business Suite
Versions 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6
OracleEnterprise Manager
Versions 9, 9.0.1
OracleEnterprise Manager Database Control
Version 10.1.2
OracleEnterprise Manager Grid Control
Version 10.1.0.2
OracleOracle10g
Versions enterprise_9.0.4_.0, enterprise_10.1.0.2, personal_9.0.4_.0, personal_10.1_.0.2, standard_9.0.4_.0, standard_10.1_.0.2
OracleOracle8i
Versions enterprise_8.0.5_.0.0, enterprise_8.0.6_.0.0, enterprise_8.0.6_.0.1, enterprise_8.1.5_.0.0, enterprise_8.1.5_.0.2, enterprise_8.1.5_.1.0
OracleOracle9i
Versions client_9.2.0.1, client_9.2.0.2, enterprise_8.1.7, enterprise_9.0.1, enterprise_9.0.1.4, enterprise_9.0.1.5

References