bugtraq - Oracle Portal 10g HTTP Response Splitting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAY114-F8D7E450685BC28D72A7B0DECF0@phx.gbl>
Date: Wed, 20 Dec 2006 14:19:02 +0000
From: "putosoft softputo" <hasecorp@...mail.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Oracle Portal 10g HTTP Response Splitting

Oracle Portal/Applications HTTP Response Splitting
--------------------------------------------------

Sample:

http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E

How an attack can be conducted?
-------------------------------

Oracle Portal is commonly used with Oracle Web Cache, which caches the most 
common used URLs.
Due to the related problem a malicious user can alter the content that the 
server will catch. It can be
used in attack to rogue cookies, usernames and passwords, etc...

Patch Information
--------------------

There is no patch at moment.

Workaround
---------------

Edit yourself calendar.jsp file and fix it, in about 5 seconds. Otherwise, 
wait for a long while an
official patch (between 6 months and 2 years).

Thanks to n0oN3

_________________________________________________________________
Acepta el reto MSN Premium: Correos más divertidos con fotos y textos 
increíbles en MSN Premium. Descárgalo y pruébalo 2 meses gratis. 
http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_correosmasdivertidos