Информационная безопасность
[RU] switch to English


Дополнительная информация

  Очередное ежеквартальное обновление безопасности Oracle

  Hacktics Advisory Feb09: XSS in Oracle E-Business Suite

  Team SHATTER Security Advisory: Buffer Overflow in Resource Manager of Oracle Database - Plan name parameter

  Oracle 11g (11.1.0.6) Password Policy and Compliance

  Bypassing DBMS_ASSERT in certain situations

From:DSecRG <research_(at)_dsecrg.com>
Date:16 июля 2009 г.
Subject:[DSECRG-09-031] Oracle BEA Weblogic 10.3 Linked ХSS vulnerability

Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-031

http://dsecrg.com/pages/vul/show.php?id=131
 
Application:                    Oracle BEA Weblogic 10
Versions Affected:              Oracle BEA Weblogic 10  
Vendor URL:                     http://oracle.com
Bugs:                           Linked XSS Vulnerability
Exploits:                       YES
Reported:                       18.03.2009
Vendor response:                19.03.2009                 
Description:                    XSS in Search   
Date of Public Advisory:        16.07.2009
Authors:                        Alexandr Polyakov
                               Digital Security Research Group [DSecRG] (research [at] dsec [dot]
ru)


Description
***********
Luinked XSS Vulnerability found in Oracle BEA Weblogic Server version 10.3.


Details
*******

Vulnerabilities found in console-help.portal script of Weblogic Server.

Linked XSS found in /consolehelp/console-help.portal. Vulnerable parameter "searchQuery"


Example
*******
http://testserver.com:7011//consolehelp/console-help.
portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery=">
<script>alert('DSECRG')</script>


Fix Information
***************


Information was published in CPU July 2009.
All customers can download CPU petches following instructions from:

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul200
9.html




Credits
*******
Oracle give a credits for Alexandr Polyakov from Digital Security Company in CPU July 2009.

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul200
9.html


Original Advisory
http://dsecrg.com/pages/vul/show.php?id=131

About
*****
Digital Security is one of the leading IT security companies in CEMEA, providing information
security consulting, audit and penetration testing services, risk analysis and ISMS-related services
and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group
focuses on application and database security problems with vulnerability reports, advisories and
whitepapers posted regularly on our website.


Contact:        research [at] dsecrg [dot] com
               http://www.dsecrg.com



Polyakov Alexandr
Chief Information Security Analyst
______________________

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород