A Security Hole in Oracle Application Server (Reports Services)

During my work in MOBILECOM as Application Integration Administrator my team leader sent me a document but when i read the title i couldn't believe it , you can crash any system has Oracle Application Server Reports Services,simply when you generate a report of type pdf and you give him the path it will overwrite the file, so if you send this URL to the server:
http://server_name:port/reports/rwservlet?server=rep_srv&report=test.rdf&destyp=file&desname=c:\WINNT\system32\AnySystemFile.dll&desformat=pdf .
It will now generate the report and replace the system file with it. After that open the system file and you will find the file is opened using Acrobat Reader,here you will found that you crashed the system and you forget to take backup and your manager will cick your A...

now for any further information about how to handle this issue and prevent anybody to play with your systems navigate to the follwoing URL and it will help u alot:

http://www.trivadis.com/Images/OASSecurityHoleE_11092005_tcm17-14060.pdf

Regards