full-disclosure - Cross-Site-Scripting Vulnerability in Oracle XMLDB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Oct  7 10:38:50 2005
From: ak at red-database-security.com (Kornbrust, Alexander)
Subject: Cross-Site-Scripting Vulnerability in Oracle XMLDB

Cross-Site-Scripting Vulnerability in Oracle XMLDB 
##################################################

 Name                Cross-Site-Scripting Vulnerability in Oracle XMLDB
 Systems Affected    Oracle Database 9i Rel. 2
 Severity            Low Risk 
 Category            Cross Site Scripting (CSS/XSS)
 Vendor URL          http://www.oracle.com 
 This advisory
http://www.red-database-security.com/advisory/oracle_xmldb_css.html
 Author              Alexander Kornbrust (ak at
red-database-security.com) 
 Date                7 October 2005 (V 1.00)

Details
########
Oracle XML DB is a feature of the Oracle Database. It provides a
high-performance
, native XML retrieval and storage technology. It fully absorbs the W3C
XML data 
model into the Oracle Database, and provides new standard access methods
for 
navigating and querying XML. 

Oracle XML DB is vulnerable against cross site scripting. 

Affected Products
#################
Oracle Database 9i Release 2 

Testcase 
########
http://scott:tiger@...erver:8080/oradb<script>alert('Hi')</script>/SCOTT
/EMP

Affected systems 
################
Tested with Oracle Database 9.0.2.4. 

Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle 
forgot to inform Red-Database-Security that this bug is fixed with CPU
July 2005.

All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html

History
#######
9-oct-2003 Oracle secalert was informed

10-oct-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing
Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory

(c) 2005 by Red-Database-Security GmbH - last update 7-october-2005