full-disclosure - Team SHATTER Security Advisory: Cross-site scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <489731AF.3040605@appsecinc.com>
Date: Mon, 04 Aug 2008 12:43:27 -0400
From: Team SHATTER <shatter@...secinc.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Team SHATTER Security Advisory: Cross-site
 scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Team SHATTER Security Advisory

Cross-site scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter)

August 4, 2008

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 10gR1, 10gR2 and 11g (11.1.0.6)

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martínez
Fayó of Application Security Inc.

Details:
Cross-site scripting vulnerabilities occur when an attacker tricks a
legitimate web application into sending malicious code, generally in the
form of a script, to an unsuspecting end user. The attack usually
involves crafting a hyperlink with malicious script code embedded within
it. A valid user is likely to click this link since it points to a
resource on a trusted domain. The link can be posted on a web page, or
sent in an instant message, or email. Clicking on the link executes the
attacker-injected code in the context of the trusted web application.
Typically, the code steals session cookies, which can then be used to
impersonate a valid user.
The "REFRESHCHOICE" parameter used in web pages of Oracle Enterprise
Manager are vulnerable to cross-site scripting attacks. User supplied
input to these parameters is returned without proper sanitization,
allowing a malicious attacker to inject arbitrary scripting code.

Impact:
Attackers might steal administrator's session cookies, thereby allowing
the attacker to impersonate the valid user.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this issue.

Fix:
Apply Oracle Critical Patch Update July 2008 available at Oracle Metalink.

Links:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2008.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2603

Timeline:
Vendor Notification - 12/27/2007
Vendor Response - 12/27/2007
Fix - 7/15/2008
Public Disclosure - 7/23/2008
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkiXMa8ACgkQ9EOAcmTuFN33twCfV6yidpr9eAmIbhvBTyY07uE6
RVIAoLKVCD5lsBM0IyksviVGbrhu1tlF
=CyQi
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/