The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.
Affected Platforms
Oracle Application Server Web CacheOracle Application ServerOracle Oracle8IOracle Oracle9I