CVE-2002-0559: oracle application_server
Vulnerability summary
CVE-2002-0559 is a high (CVSS 7.5) vulnerability in oracle application_server. EPSS estimates a 13.14% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.
Timeline
- 11-06-2002PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long HTTP request to the plsql module, (3) a long password in the HTTP Authorization, (4) a long Access Descriptor (DAD) password in the addadd form, or (5) a long cache directory name.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.14%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.14% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle4 products
- application_server1.0.2
- application_server_web_cache2.0.0.0 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3
- oracle8i8.1.7 | 8.1.7.1
- oracle9i9.0 | 9.0.1
1 vendor · 4 products
References
14 links- www.cert.org/advisories/CA-2002-08.htmlThird Party AdvisoryX Refsource CERTPatchUS Government Resource
- www.nextgenss.com/papers/hpoas.pdfX Refsource MISC
Show all 14 references
- otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdfX Refsource CONFIRM