From: "putosoft softputo" <hasecorp@hotmail.com.>
To: [email protected], [email protected]Subject: Oracle Portal 10g HTTP Response Splitting
Date: Wed, 20 Dec 2006 14:19:02 +0000
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
X-OriginalArrivalTime: 20 Dec 2006 14:19:07.0078 (UTC) FILETIME=[CF2EE660:01C72441]
X-Virus-Scanned: antivirus-gw at tyumen.ru
Oracle Portal/Applications HTTP Response Splitting
Sample:
http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
How an attack can be conducted?
Oracle Portal is commonly used with Oracle Web Cache, which caches the most
common used URLs.
Due to the related problem a malicious user can alter the content that the
server will catch. It can be
used in attack to rogue cookies, usernames and passwords, etc...
Patch Information
--------------------
There is no patch at moment.
Workaround
---------------
Edit yourself calendar.jsp file and fix it, in about 5 seconds. Otherwise,
wait for a long while an
official patch (between 6 months and 2 years).
Thanks to n0oN3
_________________________________________________________________
Acepta el reto MSN Premium: Correos más divertidos con fotos y textos
increíbles en MSN Premium. Descárgalo y pruébalo 2 meses gratis.
http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_correosmasdivertidos
