CVE-1999-1125

High

Published: 19/09/1997(UTC)Updated: 16/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.72%

88th percentile - higher than 88% of all known CVEs

Summary

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account. This allows any local or remote attacker who gains access to the oracle account to gain privileges or modify arbitrary files by altering the configuration file.

Risk Assessment

Attackers may gain unauthorized access to the system, potentially leading to serious security breaches and loss of data integrity.

Recommendation

It is recommended to restrict access to the oracle account and review and secure the configuration file to prevent unauthorized modifications.

Other vulnerabilities in Oracle Webserver

CVE-1999-1068Medium
Oracle Webserver 2.1 allows remote attackers to cause a denial of service via a long HTTP GET request when serving PL/SQL stored procedures.

Original NVD description (English source)

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.