Computer Security
[EN] securityvulns.ru no-pyccku


Multiple Oracle application server vulnerabilities
updated since 19.04.2005
Published:23.12.2006
Source:
SecurityVulns ID:4707
Type:remote
Threat Level:
8/10
Description:SQL injections, DoS, data modification, crossite scripting, privilege escalation, audit setings modification. Password is passed from JDeveloper to SQLPlus in cleartext. JDeveloper password is stored in cleartext in different XML configuration files. Cleartext FormBuilder password is stored in temporary files. Weak permissions for temporary files. Reading and writing any file with Oracle Reports. Command execution with Oracle Forms and Oracle Reports. There is also a large number of different old and new bugs, many are not fixed for years. It makes it useless to talk about Oracle security. Use 3rd party products to protect your Oracle environment.
Affected:ORACLE : Oracle 9i
 ORACLE : Oracle E-Business Suite 11.0
 ORACLE : Oracle 10g
 ORACLE : JDeveloper 9.0
 SUN : SunMC 3.5
 ORACLE : Oracle E-Business Suite 11i
 ORACLE : APEX/HTMLDB 2.2
CVE:CVE-2005-4832 (SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.)
 CVE-2005-1197 (SQL injection vulnerability in the SYS.DBMS_CDC_IPUBLISH.CREATE_SCN_CHANGE_SET procedure in Oracle Database Server 10g allows remote attackers to execute arbitrary SQL commands via the CHANGE_SET_NAME parameter.)
Original documentdocumentputosoft softputo, Oracle Applications/Portal 9i/10g Cross Site Scripting (23.12.2006)
 documentputosoft softputo, Oracle Portal 10g HTTP Response Splitting (20.12.2006)
 documentKornbrust, Alexander, Modify Data via Inline Views (26.10.2006)
 documentKornbrust, Alexander, Various Cross-Site-Scripting Vulnerabilities in Oracle Reports (26.10.2006)
 documentKornbrust, Alexander, Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATION_MSG (26.10.2006)
 documentKornbrust, Alexander, Cross-Site-Scripting Vulnerability in Oracle APEX WWV_FLOW_ITEM_HELP (26.10.2006)
 documentKornbrust, Alexander, SQL Injection in Oracle package MDSYS.SDO_LRS (26.10.2006)
 documentKornbrust, Alexander, SQL Injection in package SYS.DBMS_CDC_IMPDP (26.10.2006)
 documentKornbrust, Alexander, SQL Injection in package XDB.DBMS_XDBZ0 (26.10.2006)
 documentKornbrust, Alexander, SQL Injection in package SYS.DBMS_SQLTUNE_INTERNAL (26.10.2006)
 documentputosoft softputo, Oracle 10g R2 and, probably, all previous versions (28.07.2006)
 documentKornbrust, Alexander, Bypassing Oracle dbms_assert (28.07.2006)
 documentKornbrust, Alexander, Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22] (24.07.2006)
 documentKornbrust, Alexander, Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21] (24.07.2006)
 documentKornbrust, Alexander, Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01] (24.07.2006)
 documentCERT, Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01] (24.07.2006)
 documentCERT, US-CERT Technical Cyber Security Alert TA06-200A -- Oracle Products Contain Multiple Vulnerabilities (24.07.2006)
 documentKornbrust, Alexander, Oracle Database - SQL Injection in SYS.KUPW$WORKER [DB03] (24.07.2006)
 documentDavid Litchfield, [Full-disclosure] Recent Oracle exploit is _actually_ an 0day with no patch (26.04.2006)
 documentc c, [Full-disclosure] [Argeniss] Oracle Database 10gR1 Buffer overflow in VERIFY_LOG procedure (20.04.2006)
 documentCERT, US-CERT Technical Cyber Security Alert TA06-109A -- Oracle Products Contain Multiple Vulnerabilities (20.04.2006)
 documentKornbrust, Alexander, [Full-disclosure] SQL Injection in package SYS.DBMS_LOGMNR_SESSION (19.04.2006)
 documentNGSSoftware Insight Security Research, Multiple critical and high risk issues in Oracle's database server (19.04.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle read-only user can insert/update/delete data via specially crafted views (10.04.2006)
 documentDavid Litchfield, More on the workaround for the unpatched Oracle PLSQL Gateway flaw (03.02.2006)
 documentDavid Litchfield, The History of the Oracle PLSQL Gateway Flaw (03.02.2006)
 documentc c, [VulnWatch] [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT} (27.01.2006)
 documentDavid Litchfield, Workaround for unpatched Oracle PLSQL Gateway flaw (26.01.2006)
 documentCERT, US-CERT Technical Cyber Security Alert TA06-018A -- Oracle Products Contain Multiple Vulnerabilities (19.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INT (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartext (18.01.2006)
 documentAmichai Shulman, [Full-disclosure] Oracle DBMS - Access Control Bypass in Login (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Reports - Read parts of files via desname (fixed after 874 days) (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Reports - Overwrite any application server file via desname (fixed after 889 days) (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Reports - Read parts of files via customize(fixed after 875 days) (18.01.2006)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGA (18.01.2006)
 documentNGSSoftware Insight Security Research, Oracle DBMS_ASSERT and the October 2005 CPU (09.11.2005)
 documentNGSSoftware Insight Security Research, Oracle October 2005 CPU Problems (09.11.2005)
 documentsnsadv_(at)_lac.co.jp, [SNS Advisory No.84] Oracle Application Server HTTP Response Splitting Vulnerability (22.10.2005)
 documentoracle_secalert_(at)_hushmail.com, [Full-disclosure] Exploit Oracle DB27 - CPU Octobre (20.10.2005)
 documentSPI Labs, Oracle 10g - emagent.exe Stack-Based Overflow (20.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Workflow CSS Vulnerability wf_route (20.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Workflow CSS Vulnerability wf_monitor (20.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Oracle Workflow CSS Vulnerability wf_monitor (20.10.2005)
 documentCERT, US-CERT Technical Cyber Security Alert TA05-292A -- Oracle Products Contain Multiple Vulnerabilities (20.10.2005)
 documentDavid Litchfield, Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Cross-Site-Scripting Vulnerability in Oracle XMLDB (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Shutdown TNS Listener via Oracle iSQL*Plus (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Shutdown TNS Listener via Oracle Forms Servlet (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB (07.10.2005)
 documentKornbrust, Alexander, [Full-disclosure] Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus (07.10.2005)
 documentc c, [VulnWatch] [Full-disclosure] [Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package (27.07.2005)
 documentc c, [Full-disclosure] [Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package (23.07.2005)
 documentSECUNIA, [SA16121] Sun Management Center Oracle Listener Vulnerabilities (19.07.2005)
 documentKornbrust, Alexander, Various Cross-Site-Scripting Vulnerabilities in Oracle Reports (19.07.2005)
 documentKornbrust, Alexander, Read parts of any XML-file via customize parameter in Oracle Reports (19.07.2005)
 documentKornbrust, Alexander, Read parts of any file via desformat in Oracle Reports (19.07.2005)
 documentKornbrust, Alexander, Run any OS Command via unauthorized Oracle Reports (19.07.2005)
 documentKornbrust, Alexander, Run any OS Command via unauthorized Oracle Forms (19.07.2005)
 documentKornbrust, Alexander, Overwrite any file via desname in Oracle Reports (19.07.2005)
 documentKornbrust, Alexander, [Full-disclosure] Silently fixed security bugs in Oracle Critical Patch Update July 2005 (15.07.2005)
 documentCERT, US-CERT Technical Cyber Security Alert TA05-194A -- Oracle Products Contain Multiple Vulnerabilities (14.07.2005)
 documentKornbrust, Alexander, Oracle Forms Insecure Temporary File Handling (13.07.2005)
 documentKornbrust, Alexander, Oracle Forms Builder Password in Temp Files (13.07.2005)
 documentKornbrust, Alexander, Oracle JDeveloper Plaintext Passwords (13.07.2005)
 documentKornbrust, Alexander, Name Oracle JDeveloper passes Plaintext Password (13.07.2005)
 documentDavid Litchfield, Problems with the Oracle Critical Patch Update for April 2005 (07.07.2005)
 documentKornbrust, Alexander, Oracle 10g Exploit dbms_scheduler SESSION_USER issue (03.05.2005)
 documentKornbrust, Alexander, Oracle Fine Grained Auditing Issue in Oracle 9i / 10g (03.05.2005)
 documentKornbrust, Alexander, Webcache Client Requests bypasses OHS mod_access restrictions (28.04.2005)
 documentKornbrust, Alexander, Append file in Oracle Webcache 9i (28.04.2005)
 documentKornbrust, Alexander, Cross Site Scripting in Oracle Webcache 9i (28.04.2005)
 documentCERT, US-CERT Technical Cyber Security Alert TA05-117A -- Oracle Products Contain Multiple Vulnerabilities (28.04.2005)
 documentSECURITEAM, [EXPL] Multiple Exploit Codes for Oracle (interMedia, DBMS_CDC_SUBSCRIBE, DBMS_CDC_ISUBSCRIBE and DBMS_METADATA) (21.04.2005)
 documentSHATTER, [AppSecInc Team SHATTER Security Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure (19.04.2005)
 documentSHATTER, [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_METADATA package (19.04.2005)
 documentSHATTER, [AppSecInc Team SHATTER Security Advisory] Denial of Service in Oracle interMedia (19.04.2005)
 documentSHATTER, [AppSecInc Team SHATTER Security Advisory] SQL Injection in CREATE_SCN_CHANGE_SET procedure (19.04.2005)
 documentSHATTER, [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE packages (19.04.2005)
Files:Oracle 9i HTTP XDB service stack overflow exploit
 exploit for Oracle 10g 10.2.0.2.0
 Exploits command exec via oracle extproc
 file system access suite for oracle

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod