CVEvulnerability

CVE-1999-1125

10.0 HIGH Published 1997-09-19 Modified 2026-06-16 Official page ↗
Status
Modified
Published
1997-09-19
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.

Affected configurations

• oracle http server (<= 2.1) • oracle http server 1.0

Related

Referenced by CWE · observed example (1)

  • CWE-282 Improper Ownership Management weakness

References