Security vulnerabilities in apache that comes with oracle database.

Hi,
We are having a QA database in Oracle enterprise version 9.2.0.4 on OS : OSF1.
Recently our security team ran a test and found that the apache1.3 that comes as component of Oracle database is prone to security vulnerabilities. Also they suggested to remove the apache or upgrade to latest as remedy.
When contacted to Oracle support, Oracle team replied apache upgrade should not be done instead latest apache seprately can be installed as reverse proxy. But when asked for steps/document there is no reply. Anyone faced this problem can provide any help/suggestion in this regard.
I am attaching some of the threads identified by our Security Team for reference.
1. Apache 1.3 HTTP Server Expect Header Cross-Site Scripting XXXX and YYYYYY ports 7782, 4889, 3339.
2. Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
3. Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>417 Expectation Failed</TITLE>
</HEAD><BODY>
<H1>Expectation Failed</H1>
The expectation given in the Expect request-header
field could not be met by this server.<P>
The client sent<PRE>
Expect: <script>alert(document.domain)</script>
</PRE>
but we only allow the 100-continue expectation.
-CR

I dont know how to find which components are using the apache. Help me if there is any way to find it. Only information i can say you is there is no other software installed that in that server other than oracle Database.

Similar Messages

Does Oracle OLAP comes with Oracle Database 10g ?

1.Does Oracle OLAP comes with Oracle Database 10g or do we need seperate software to have this ?.
2.If I create a Cube with Analytic work space manager the cube is going to be stored in the Database ( meaning the in the table space where OLAP is Stored).
3. What is the difference between Analtyic work space manager and discoverer For Olap.
Help is higly appreciated ..
Thanks, Prasad

One thing to point out : The OLAP option is a costed database option, so while this is automatically installed and part of your database you do have to purchase additional licenses to use this feature. You will need to check with your Oracle account manager to see if you are actually licensed to use this feature.
If you have existing 9i OLAP cubes these can be quickly and easily migrated to 10g OLAP and the documentation explains how to do this. However, there are many new features that are part of 10g OLAP that will improve the performance of your data model that will not be enabled as part of a migration process. Based on my experiences it would be quicker and easier (depending on the size of your existing 9i OLAP cubes) to consider rebuilding your data model using these new 10g features. You should be able to export all the dimensions to XML templates from 9i OLAP and import the templates into the 10g schema and reload your dimensions.
For the cubes you will probably want to consider using partitioning, composites and compression to provide maximum flexibility and performance for your new data model. There is more information on these features within the OLAP documentation and in the many whitepapers and presentations on the OLAP home page on OTN.
For moving data from SQL Server to 10g OLAP much depends on the nature of the data transfer. If it is a one-off bulk data load then you could consider using the normal MS command line tools to dump the data out and transfer it to Oracle. Alternatively, you could consider using Oracle Data Integrator to manage the extraction of the SQL Server data and the data load process into Oracle 10g relational tables. If you decide to use Data Integrator this will require additional licenses.
If you can extract the data from SQL Server to flat files you can use Oracle Warehouse Builder (basic ETL is free as part of the 10g database license) to load that flat file data via external tables. Warehouse Builder can also be used to define your OLAP data model (think of Warehouse Builder as a more powerful version of Analytic Workspace Manager) and provides tools to load the data directly into your OLAP dimensions and cubes. You can get more information on managing OLAP data models with Warehouse Builder the Warehouse Builder home page on OTN.
There are no facilities to modify Discoverer Viewer to add customisations. You can add company logos, modify certain colors and/or hide certain features but it is not possible to add additional features. You may want to consider using BI Beans to provide this type of environment. BI Beans is the development framework used to create Discoverer Viewer. You can create customised JSP pages that look identical to Discoverer Viewer pages with the added benefit of providing your own specific features. You can get more information on the BI Beans home page on OTN.
Keith Laker
Oracle EMEA Consulting
BI Blog: http://oraclebi.blogspot.com/
DM Blog: http://oracledmt.blogspot.com/
BI on Oracle: http://www.oracle.com/bi/
BI on OTN: http://www.oracle.com/technology/products/bi/
BI Samples: http://www.oracle.com/technology/products/bi/samples/

Creating Managed Server for Weblogic that comes with Oracle Service Bus

I've installed Oracle Service Bus 10.3.
Weblogic Server 10.3 comes bundled with OSB 10.3.
Everything is working fine in the Admin Server.
But when I create a Managed server and try to start it, I get the following exception and server doesn't start :
####<Nov 10, 2009 10:24:32 AM IST> <Critical> <Security> <iflmud6dlb5jn> <OSBManagedServer2> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1257828872747> <BEA-090403> <Authentication for user weblogic denied>
####<Nov 10, 2009 10:24:32 AM IST> <Critical> <WebLogicServer> <iflmud6dlb5jn> <OSBManagedServer2> <main> <<WLS Kernel>> <> <> <1257828872747> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: Authentication for user weblogic denied
weblogic.security.SecurityInitializationException: Authentication for user weblogic denied
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.doBootAuthorization(Unknown Source)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(Unknown Source)
     at weblogic.security.service.SecurityServiceManager.initialize(Unknown Source)
     at weblogic.security.SecurityService.start(SecurityService.java:141)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I've tried changing the boot.properties file and given clear text username and password, but even this did not change the exception.
Are there any other security concerns that are to be taken care of while configuring Managed Server for Oracle Service Bus?
Kindly help.

How are you starting the manageserver. Is it using command line or using NodeManager from Weblogic console of admin server. Most of the times we start managed server using yourDomain/bin/startManagedWebLogic.cmd (.sh).
startManagedWebLogic nameOfYourManagedServer adminURL(Ex: http://host:port).
If you created a managed server at the time of creation of domain itself using custom option, then under your domain root folder, you should see a file named like "startManagedWebLogic_readme.txt" that kind of gives the same above command.
If you added the managed server later on, to an existing single server domain, then you can use the above command.
Ravi Jegga

What is JSF version of Oracle ADF that come with Jdev 10.1.3.1.0

HI
tahank you for reading my post
which version of JSF used in oracle ADF that comes with jdev 10.1.3.1 ?
thanks

JDeveloper ships with JavaServer Faces (JSF) Reference Implementation 1.1_01
Hope this helps
Regards
Grant Ronald
oracle Product management

What is the SAX2 Driver that comes with JDK1.4?

What is the SAX2 Driver that comes with JDK1.4?
Thanks,
Aaron

The following are SAX2 System Property values for org.xml.sax.driver (used when implementing XMLReaderFactory):
Xerces2 - org.apache.xerces.parsers.SAXParser
Crimson - org.apache.crimson.parser.XMLReaderImpl
Per the Xerces2 documentation the SAX2 Parser in Xerces2 will implement the same package name as Xerces to maintain backward compatibility. Will applications that implement the Crimson SAX2 driver in the JDK 1.4 be hosed once Xerces2 is implemented in the JDK?
The SAX2 driver provided with the JDK will change from org.apache.crimson.parser.XMLReaderImpl to org.apache.xerces.parsers.SAXParser. That will put many SAX2 applications at risk if the programmer is relying on a SAX2 driver provided with the JDK.
Is a solution to this issue being worked on?
Thanks,
Aaron

What is the version of APEX that comes with DB 11.2.0.2?

What is the version of APEX that comes with DB 11.2.0.2? Is it 4.0?
Where can I confirm this, is there a list of DB features and versions for 11.2.0.2?
Am I correct in thinking there currently a patch for Apex 4.0.2.?
Thanks
Will

Hi Will,
I believe APEX 3.2 is still shipped with Oracle 11g but I could be wrong.
All the documentation regarding 11g r2 can be found at:
http://www.oracle.com/pls/db112/portal.portal_db?selected=1&frame=#new_to_oracle_database_11g
The information regarding the patch can be found in Joels Blog:
http://joelkallman.blogspot.com/2011/04/application-express-40-and-library.html
Thanks
Paul

What is the portal that comes with webcenter suite 11g?

Hello,
What is the portal that comes with webcenter suite 11g?
How to retrieve the content from UCM using this portal?
-Scott

Scott,
The JCR adpater can be configured against Oracle Content Server(UCM), file system and Oracle Portal. This gives you only the read feature on the repository. However the web center frame work also provides you the Document Library Task flows with both Read/Write capabilities and other capabilities like recent documents, search etc. The task flows can also customized to suit your UI requirements as well. In addition to this there is a content presenter Task flow available where Business Users can display formatted content from UCM on web center page. This is similar to the content presenter portlet available inside WLP.
Regards
Vijay

APEX V3 that comes with 11g -- Fundamentally broken?

I have two instances of APEX v3 running. One was an upgrade from HTMLDB v2.0 the other is the version that came with 11g. The 11g version seems to be fundamentally broken and buggy. It continually asks me for an XDB login, the applications that I can import into the upgraded v3 version, import into this version missing half of the components. This list of bugs and fixes is becoming endless.
I have read the notes, this forum, and have an SR on the matter. Most people seem to be aware of the APEX 11g issues and I have been able to fix some of them. I am wondering if I should uninstall the version that came with the database and install the stand-alone version. Thoughts?

j_70,
When you installed 11g, did you do a clean database install or did you do an upgrade? I tried doing the upgrade process 5 times and they all had problems, so I finally settled on a clean install (software only), then created a database with all of my tablespaces, then exported and imported all of the data from my 10g database. The upgrade process was (once again) unusable for me.
If you did a process similar to mine above, when you imported, did you export and import the Apex schemas? That doesn't work at all, and does lead to numerous problems. The Apex schemas need to have the applications exported and the imported back through the Apex interface. That is the only way it works if you are changing versions like going from 10g with Apex 3.0.1.0.7 to 11g with 3.0.1.0.8 (I probably got the Apex versions wrong). Otherwise, you wind up with some of the older Apex 'data' (tables, data, etc.) overwriting the newer version in 11g, and that causes problems. This is exactly like the case of not importing the system (system, sys, sysaux) schemas into a newer version.
If you're not the DBA, ask your DBA how the 11g install was performed. It could be that they did the 11g install the wrong way. I know this was my most difficult upgrade process yet, and I've been doing this since version 5, about 16 years now.
Anyway, the point of all of the above is that when done properly, Apex itself doesn't have any problems. Actually, the Oracle database didn't have any 'major' problems either (a few minor ones, but I worked through those finally). But, when done improperly, the data migration from an old version to a new version can cause all kinds of problems. Based on what I experienced when I migrated my system from 10g to 11g, it sounds like this may be what you are experiencing. And none of this has anything to do with Apex.
I would suggest uninstalling Apex, then install it fresh (so you know you have a working, clean install), then import your applications through the Apex interface. You shouldn't have any problems if you do it this way.
For the record, I would also trust what Tyler, Joel, Scott Spadafore and Carl say a lot more than Oracle Support, especially when it comes to Apex.
My last experience with Oracle Support was with a problem I had in 11g with views that use the ANSI join syntax. I used the USING clause, since I was performing the join between three tables that had a common column name (per all of the documentation), but I kept getting a 'unabiguous column' error message. The 'fix' was to change all of my views to use the ON syntax instead. Oracle Support insisted that this is the correct behaviour, even though all the documentation I've seen everywhere states otherwise. In short, Oracle Support is good in that they will eventually get you working again, but they are not experts.
Send Joel the SR# so he can investigate further. I'm pretty darn sure that he'll discover in this case Oracle Support was wrong (again), and have a solution for you if the above uninstall, import process doesn't fix your problem.
Bill Ferguson

Procedure Builder does not come with Oracle 9iDS r2 (Complete)?

Hi All
I have enjoyed using Procedure Builder - but did not see opportunity to install with the Developer Suite.
Does anyone know where I could get PB? I am not interested in using the version that comes with Forms 6i...
Thank you!

Procedure Builder is no longer a stand alone product.
You can still edit and debug PL/SQL procedures from inside Oracle9i Forms.
You might also want to take a look at the PL/SQL development capabilities of Oracle9i JDeveloper.
It gives you the ability to debug PL/SQL stored procedures and it also has a helpful code insight when you write PL/SQL code in it.
Check out the Database Development viewlets at http://otn.oracle.com/products/jdev/viewlets/viewlet.html

Firefox will not open web pages that are called from the mail program that comes with Vista, anyone out there have a solution?

I have installed Firefox ver 4 on a Toshiba laptop running Vista. My problem is when using the mail client that comes with Vista any url in an email message will not load in the browser, a new tab is created and has the url from the mail message but that is as far as I get. There is no revolving icon on the new tab and clicking on reload does nothing. So far this is happening with every website I have tried. There is no error message of any kind. The websites are working sites and can be opened if I navigate to them manually

I have installed Firefox ver 4 on a Toshiba laptop running Vista. My problem is when using the mail client that comes with Vista any url in an email message will not load in the browser, a new tab is created and has the url from the mail message but that is as far as I get. There is no revolving icon on the new tab and clicking on reload does nothing. So far this is happening with every website I have tried. There is no error message of any kind. The websites are working sites and can be opened if I navigate to them manually

Problem with crystal report that comes with VStudio 2008 Database edition

Hello,
I'm using crystal reports that comes with Visual Studio 2008 Database edition. But I'm having a problem these days. When there are more than 4 pages in the report, the summary field in the pagefooter(usually sum of data in the Details section) show 0 in the first page.It will be displaying in all other pages. I couldnt sort out the problem.I'm binding data to the report from an SQL Server 2005 table.
Thanks in advance.I really appreciate if some one can sort out the problem quickly.

Have not heard of the issue, but download SP1 and see if that helps:
https://smpdl.sap-ag.de/~sapidp/012002523100009351512008E/crbasic2008sp1.exe
Ludek
Follow us on Twitter http://twitter.com/SAPCRNetSup

Hello apple guys, i can't open app store, reminders, contacts, mail(crash), maps, Image Capture, and other apps that comes with Mavericks OS, how i can solve this problem?

hello apple guys, after installing OS X Mavericks, i can't open app store, reminders, contacts, mail(crash), maps, Image Capture, and other apps that comes with Mavericks OS, how i can solve this problem?

So is this the way Apple works now? Not solving customers problems? I'm sure so many users have had this problem. I've had, and I reinstalled Mavericks 3 times. Works fine for some days and then several Apple Apps stop working. Is that a way to force us ti update to Yosemite? (I don't want to) and then pay to update some third party programs (i.e. Pro Tools). Also, there are so many 15" MacBooks Pro with graphic problems and of course the guys at the Apple Service Centers always say: "It's the logic board, you can have it replaced, but it's so expensive I would recommend a new Mac". I really, really miss Steve Jobs!

How do I write to my boot camp partition with Paragon NTFS that comes with Mountain Lion? Or how do I get my boot camp partition to show up in Paragon's "Available NTFS partitions:" panel like my external hard drive does?

I've just set up boot camp on my MacBookPro with a freshly installed Mountain Lion and Windows 7.
I would like to read and write in both directions from drive to drive if possible. I've hunted around quite a bit to try and work this out, and so far I understand that one can write to or transfer files from one drive to the other with Paragon NTFS among other softwares.
I noticed when I looked in my system preferences the utility "Paragon NTFS for Mac OS X" came with Mountain Lion and it will recognize an external hard drive when I have one plugged in under "Available NTFS partitions:". However, it does not automatically recognize my NTFS boot camp partition nor does it automatically give me write access.
Is the Paragon NTFS that comes with Mountain Lion limited in some way?
Do I still need to purchase and download the software of the same name from Paragon to get the full write privilidges I want or is there something I can do to get the version of Paragon on my MAC to recognize and give me write priviledges to my boot camp partition?
I'm open to all suggestions to get the read / write access between partitions in my boot camped drive.
MacFUSE is also listed in the System Preferences of my machine (it also came with Mountain Lion), if that helps. I'm still working out exactly what each of these is supposed to do and how I can use it to accomplish the task at hand.
My boot camp drive does appear normally in other contexts and in disk utility it indicates that the drive is mounted.
Thank you for any guidance you can give me.

Interesting. Comes with? you didn't have either before? Paragon is commercial and is now v. 10.0, they were the only one keeping updated and was supporting 10.7.4. I would not enable more than one.
For writing to HFS Paragon has theirs but probably give the nod to MacDrive there.
I never do an upgrade to a new OS over the old system, I backup (clone) and format the drive with the new OS and do the install so whatever is there I know is clean and also to keep from carrying around leftovers from years and systems past.
I would assme Paragon is limited. Try their site and knowledge base?
MacDrive
http://www.mediafour.com/updates/macdrive
Paragon HFS
http://www.paragon-software.com/home/hfs-windows/
Paragon NTFS
http://www.macupdate.com/app/mac/26288/ntfs-for-mac-os-x
http://www.paragon-software.com/home/ntfs-mac/

All of the free music that comes with iMovie is suddenly missing. How do I get it back?

I wanted to start a new project in iMovie, and I realized all of the iLife music is gone. I'm not talking about my iTunes songs, which are all there. I'm talking about the free music that comes with iMovie/iLife. I used some of the music in a previous project, and that still plays, but I can't access the music anymore from the music tab.
The iLife sound effects are still there, but all the music is gone.
Please help.

sugaryyellowman wrote:
I can't see any folder called 'iLife Sound Effects'. Also, I cant find any jungles when I search jingles. But, I can get jingles in iMovie (I can't seem to find them on garageband)
See the following screenshot from GarageBand - firstly click on Apple Loops in the top right corner, then on Jingles in the listing of items that appear below that. You should now see all the Jingles in the panel at the bottom right of the window.
Hope this works for you!
John

IPad won't display my Gmail contacts in the Contacts app that comes with the IPad.

I have never been able to get my Gmail contacts imported into the Contacts app that comes with the IPad.

If you can be more specific about what you have tried, someone might be able to offer other solutions.
I sync my contacts and calendar with Gmail too. I don't use iCloud for syncing contacts. I have set it up as an exchange account. That works on both my ipad and iphone. Any changes made to either is reflected on the other.
Settings>Mail, Contacts, Calendars>Add new account>Microsoft Exchange. Leave out the domain name. The server when asked is m.google.com. Turn on contacts (and calendar or mail if you use them) and that's it.
If that does not work, perhaps you can describe what issue you are having.

Security vulnerabilities in apache that comes with oracle database.

Similar Messages

Maybe you are looking for