Re: 11226 - Oracle 9iAS default error information disclosure

From: Javier Fernandez-Sanguino (jfernandezat_private)
Date: Mon Feb 17 2003 - 06:43:31 PST

  • Next message: Michel Arboi: "www hidden name" 

    Paul Johnston wrote:
>>> path = ereg_replace(pattern: string("(java.io.FileNotFoundException:
>>> )(.*)(",errorjsp,")(\(No such file or directory\))"), replace:"\2", 
>>> string:
>>> location);
>>
>>
>> I believe you have just changed path to location. Am I right? 
> 
> 
> Well, the crucial change is that I'm saving the return of ereg_replace 
> back into path. This function doesn't change the string in-place; it 
> returns the changed string. I think that's why you couldn't get it to work.

	Of course, I missed the path=. Ok, I've changed it and tested it  with 
the remote Oracle 9iAS server I have at hand:

$ sudo nasl -t XXXXXX oracle9i_jspdefaulterror.nasl
Unknown escape sequence '\('
Unknown escape sequence '\)'
The web root physical is returned here: java.io.FileNotFoundException: 
/XXXXXX/nonexistant.jsp (No such file or directory)

I'm using:
          path = ereg_replace(pattern: 
string("(java.io.FileNotFoundException: )(.*)(",errorjsp,")\((No such 
file or directory\))"), replace:"\2", string: location);

If I change it to:
path = ereg_replace(pattern: string("(java.io.FileNotFoundException: 
)(.*)",errorjsp), replace:"\2", string: location);

$ sudo nasl -t XXXX oracle9i_jspdefaulterror.nasl
The web root physical is returned here: /usr/aplic_ICM/prod/web (No such 
file or directory)

So I guess the problem lies in the "(No such file or directory)"

In order to prevent this I'm changing it to:
  path = ereg_replace(pattern: string("(java.io.FileNotFoundException: 
)(.*)",errorjsp,".*"), replace:"\2", string: location);


Which seems to work ok.
I'll send a patch to the bug tracking system. Thanks.


Javi

    This archive was generated by hypermail 2b30 : Mon Feb 17 2003 - 06:53:22 PST