lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri Oct  7 10:34:31 2005
From: ak at red-database-security.com (Kornbrust, Alexander)
Subject: Cross-Site-Scripting Vulnerability in Oracle
	iSQL*Plus

Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus 
######################################################

 Name                Cross-Site-Scripting Vulnerability in Oracle
iSQLPlus
 Systems Affected    Oracle Database 9i Rel. 2
 Severity            Low Risk 
 Category            Cross Site Scripting (CSS/XSS)
 Vendor URL          http://www.oracle.com
 This advisory
http://www.red-database-security.com/advisory/oracle_isqlplus_css.html
 Author              Alexander Kornbrust (ak at
red-database-security.com) 
 Date                7 October 2005 (V 1.00)

      

Details
#######
Oracle iSQL*Plus is a web interface to SQL*Plus and vulnerable against
cross site scripting.


Affected Products
#################
Oracle Database 9i Release 2 


Testcase 
########

1. Start iSQLPlus and login as user scott (http://myserver/isqlplus )

2. set markup HTML TABLE ><script>alert(document.cookie);</script>

3. select a table (e.g. select * from cat)

==> a window pops up



Affected systems 
################
Tested with Oracle Database 9.0.2.4. 


Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle 
forgot to inform Red-Database-Security that this bug is fixed with CPU
July 2005.

All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html


History
#######
5-nov-2003 Oracle secalert was informed

6-nov-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing
Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory


(c) 2005 by Red-Database-Security GmbH - last update 7-october-2005 

Powered by blists - more mailing lists