Full Disclosure mailing list archives
Oracle Portal 10g HTTP Response Splitting
From: "putosoft softputo" <hasecorp () hotmail com>
Date: Wed, 20 Dec 2006 14:19:02 +0000
Oracle Portal/Applications HTTP Response Splitting -------------------------------------------------- Sample: http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E How an attack can be conducted? ------------------------------- Oracle Portal is commonly used with Oracle Web Cache, which caches the most common used URLs. Due to the related problem a malicious user can alter the content that the server will catch. It can be used in attack to rogue cookies, usernames and passwords, etc... Patch Information -------------------- There is no patch at moment. Workaround --------------- Edit yourself calendar.jsp file and fix it, in about 5 seconds. Otherwise, wait for a long while an official patch (between 6 months and 2 years). Thanks to n0oN3 _________________________________________________________________ Acepta el reto MSN Premium: Correos más divertidos con fotos y textos increíbles en MSN Premium. Descárgalo y pruébalo 2 meses gratis. http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_correosmasdivertidos _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Oracle Portal 10g HTTP Response Splitting putosoft softputo (Dec 20)
- Re: Oracle Portal 10g HTTP Response Splitting Brian Eaton (Dec 20)
- <Possible follow-ups>
- Re: Oracle Portal 10g HTTP Response Splitting putosoft softputo (Dec 22)