CVE:CVE-2002-0563
CNNVD:CNNVD-200207-036
Oracle 9i Application Server 1.0.2.x版本的默认配置存在漏洞。远程匿名用户可以无认证访问敏感服务，包括可以被用来控制Java进程的Dynamic Monitoring Services(1)dms0、(2)dms/DMSDump、(3)servlet/DMSDump、(4)servlet/Spy、(5)soap/servlet/Spy和(6)dms/AggreSpy;以及Oracle Java Process Manager(7)oprocmgr-status和(8)oprocmgr-service。
solution:Upgrade oracle application_server to a higher version than 1.0.2,and avoid the version 1.0.2; Upgrade oracle application_server_web_cache to a higher version than 2.0.0.0,2.0.0.1,2.0.0.2,2.0.0.3,and avoid the version 2.0.0.0,2.0.0.1,2.0.0.2,2.0.0.3; Upgrade oracle oracle8i to a higher version than 8.1.7,8.1.7_.1,and avoid the version 8.1.7,8.1.7_.1; Upgrade oracle oracle9i to a higher version than 9.0,9.0.1,and avoid the version 9.0,9.0.1