Full Disclosure mailing list archives
Re: XSS in Oracle default fcgi-bin/echo
From: paul.szabo () sydney edu au
Date: Thu, 14 Oct 2010 07:49:01 +1100
Dear Thor,
Hmm... maybe difficult to verify, since I did not post a PoC test. Maybe a kind Oracle admin could point me to a patched fcgi-bin/echo? Funny if any such existed: an admin careful to keep patches up-to-date, but careless in not following security recommendations to remove... Maybe, contact me off-list so I can provide PoC?If you are going to give PoC code to anyone who asks for it, why not just post it? It will be made public anyway. Or you could apply the patch yourself and test on your own and communicate any vulnerabilities that my persist to Oracle first.
You make wrong assumptions, and jump to conclusions: - Not anyone, but bona-fide ones only. - I do not "own" an Oracle site to test. Were not those obvious to right-thinking people? Cheers, Paul Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 07)
- Re: XSS in Oracle default fcgi-bin/echo Nahuel Grisolia (Oct 08)
- Re: XSS in Oracle default fcgi-bin/echo psy (Oct 09)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 10)
- Re: XSS in Oracle default fcgi-bin/echo psy (Oct 09)
- <Possible follow-ups>
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Riyaz Walikar (Oct 17)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 18)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Nahuel Grisolia (Oct 08)