Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace.

Hopefully, you can get the same result by going to the page as well: http://www.dot.gov/airconsumer/air-travel-complaint-comment-form

If not, I've included two screenshots of the page (it wouldn't fit into 1)

DOT Error 1

DOT Error 2

Can this result in a breach of security or is it a non-issue (just an inconvenience and unprofessional page)?

What sensitive information is there on the page and how can it be exploited?

I am asking from a purely academic perspective, and have no intention of trying to enter unlawfully into the DOT's site.

share|improve this question

4 Answers 4

up vote 30 down vote accepted

DOT's backend Oracle database is down due to ORA-27101.

ORA-27101 has a nice explanation here with a useful reader comment stating that it happened to them because the Windows Event log was full.

From the output, you can learn that they have Oracle, Java JDBC, Drupal, ColdFusion. You also see some SQL code. With that knowledge you can start digging for vulnerabilities in those products/technologies.

The output mostly means that the DOT Database Administrator will have a hot day and that the page should be back soon. Feel free to notify the administrator as it says on the page.

share|improve this answer

This message is not a security issue by itself. It's just a message. But it gives you a lot of information which you shouldn't get normally. With this information you could start searching through exploit-db and offensive-security if you are not familiar with writing exploits on your own.

share|improve this answer

I would argue that this is in fact a security issue, since they are not preventing an verbose error message from being exposed. This might indicate that with enough effort, you could replicate such behaviour somewhere else (by provoking errors) and therefore collecting lots of information about their technologies and configurations.

share|improve this answer

It could represent less work trying to hack them by SQL injection, but nothing here ease the access to their database, that's what I think.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.