Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server

guest · May 11, 2020

Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server
Security patches will not be issued to fix the problems
May 11, 2020
https://www.zdnet.com/article/data-...y-flaws-exposed-in-oracle-iplanet-web-server/

A set of vulnerabilities impacting Oracle's iPlanet Web Server has been disclosed by researchers.

Tracked as CVE-2020-9315 and CVE-2020-9314, the security flaws allow for sensitive data exposure and limited injection attacks.
First discovered by Nightwatch Cybersecurity researchers on January 19, 2020, the issues were found in the web administration console of the enterprise server management system.

"Since Oracle no longer supports Oracle iPlanet Web Server 7.0.x, the policy is that there is no coordinated disclosure involving Oracle," the company said. "Reporters who discover security vulnerabilities in products that Oracle no longer supports are free to disclose vulnerability details without Oracle participation."
Click to expand...

Following the discoveries, the researchers initially sent their findings to Cisco on January 24. The tech giant rejected the reports twice as the product is no longer supported, but the security flaws were still referred to MITRE for CVE assignment. By February 2, the agency had assigned CVE numbers, leading to public disclosure in May.
Click to expand...

Nightwatch Cybersecurity: Two vulnerabilities in Oracle’s iPlanet Web Server (CVE-2020-9315 and CVE-2020-9314)

AFFECTED VERSIONS AND MITIGATIONS
Version 7 has been tested and found to be vulnerable, however, it is unknown whether earlier versions are affected. Latest versions of Oracle Glassfish and Eclipse Glassfish application server (v5) share common code with the affected product but have been tested and do not seem to be vulnerable.

Users are encouraged to implement other controls to mitigate these vulnerabilities such as restricting network access to the administration console from the Internet or switching to a supported platform.
Click to expand...

Log in or Sign up

Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server

guest Guest

Log in or Sign up

Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server

guest Guest

Useful Searches