bugtraq - RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF16E6E7395@EX2010.hammerofgod.com>
Date: Wed, 13 Oct 2010 20:42:16 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "paul.szabo@...ney.edu.au" <paul.szabo@...ney.edu.au>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo

>Hmm... maybe difficult to verify, since I did not post a PoC test.
>Maybe a kind Oracle admin could point me to a patched fcgi-bin/echo?
>Funny if any such existed: an admin careful to keep patches up-to-date, but
>careless in not following security recommendations to remove...
>Maybe, contact me off-list so I can provide PoC?

If you are going to give PoC code to anyone who asks for it, why not just post it?   It will be made public anyway.  Or you could apply the patch yourself and test on your own and communicate any vulnerabilities that my persist to Oracle first.

t