Vulnerability -- Oracle 9iAS DMS / JPM Pages Anonymous Access

To remove this vulnerability from your E-Biz suite implementation,

1. Modify the following section in httpd.conf and httpd_pls.conf

From,

<IfModule mod_dms.c>
  <Location /dms0>
    SetHandler dms-handler
</Location>
</IfModule>


To,


<IfModule mod_dms.c>
  <Location /dms0>
    SetHandler dms-handler
    Order Deny,Allow
    Deny from all
</Location>
</IfModule>


2. Modify trusted.conf

From,

 <Location ~ "/(dms0|DMS|Spy|AggreSpy)">
 Order deny,allow
  Allow from all

To,

 <Location ~ "/(dms0|DMS|Spy|AggreSpy)">
 Order deny,allow
 Deny from all
 


3. Modify httpd_pls.conf,

Add the following to VirtualHost,

 <Location ~ "/(dms0|DMS|Spy|AggreSpy)">
 Order deny,allow
 Deny from all
 </Location>



Modify it From,

<VirtualHost _default_:*>
  <Location />
    Order deny,allow
    Allow from all
    Allow from localhost
     </Location>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
</VirtualHost>

To,

<VirtualHost _default_:*>
  <Location />
    Order deny,allow
    Allow from all
    Allow from localhost
    </Location>
 <Location ~ "/(dms0|DMS|Spy|AggreSpy)">
 Order deny,allow
 Deny from all
 </Location>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
</VirtualHost>

4. Restart Apache.