WaratekVRT Sign in

CVE-2002-0559 Oracle Application Server

Affected softwareOracle Application Server
Severity7.5 High CVSS 2.0
Published3 Jul 2002
Updated16 Jun 2026

Description

Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long HTTP request to the plsql module, (3) a long password in the HTTP Authorization, (4) a long Access Descriptor (DAD) password in the addadd form, or (5) a long cache directory name.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 24 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 13% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Products and versions

4 products, 9 version entries
SourceVendorProductSchemeAffected versions
nvd oracle application server generic 1.0.2
nvd oracle application server web cache generic 2.0.0.0 · 2.0.0.1 · 2.0.0.2 · 2.0.0.3
nvd oracle oracle8i generic 8.1.7 · 8.1.7.1
nvd oracle oracle9i generic 9.0 · 9.0.1

References

URLTags
http://online.securityfocus.com/archive/1/254426 Patch, Vendor Advisory
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://www.cert.org/advisories/CA-2002-08.html Patch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/313280 US Government Resource
http://www.kb.cert.org/vuls/id/659043 US Government Resource
http://www.kb.cert.org/vuls/id/750299 US Government Resource
http://www.kb.cert.org/vuls/id/878603 US Government Resource
http://www.kb.cert.org/vuls/id/923395 US Government Resource
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4032 Patch, Vendor Advisory

Timeline
Published2002-07-03By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.