I just saw on Alex's site this evening that he has written and released three new Oracle security advisories today (26-Apr-2005). These are as follows:
"Webcache Client Requests bypasses OHS mod_access Restrictions" - This bug advises that it is possible to access protected URL's by using webcache. There is a workaround to add "UseWebCacheIP ON" to the httpd.conf file. Alex also informs us that Oracle fixed the issue by adding the UseWebcacheIP parameter to the Oracle HTTP Server but more importantly there was no advisory released by Oracle to tell customers of the fix. It is not clear which version / patch fixed the issue.
"Append file vulnerability in Oracle Webcache 9i" - Alex advises us that it is possible to corrupt any Oracle Application Server installation file by adding garbage to the file such as httpd.conf. Alex provides an example URL. Again Alex tells us that this issue was fixed by Oracle (no version / patch information as to when it was fixed) without informing him or its customers.
"Cross Site Scripting in Oracle Webcache 9i" - Alex tells us that there are many parameters that are vulnerable to XSS/CSS attacks and by combining with the previous bug it is possible to corrupt any Oracle Application Server installation. Alex gives us three example URL's that could be used. Again Oracle have fixed the issue, no version/patch indication is given and again Alex says he was not informed and neither were customers.
Anyone using Oracle's application server and webcache in particular should make themselves aware of these issues.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Tom talks about direct dictionary editing"] [Next entry: "A new paper on Oracle database passwords"]
April 2005
- New presentation on advanced SQL Injection - 04/01/2005 by 04/01/2005
- identity theft and database security - 04/02/2005 by 04/02/2005
- Alex Kornbrusts repscan tested and added to oracle security tools page - 04/03/2005 by 04/03/2005
- Pete's audit scripts updated - 04/04/2005 by 04/04/2005
- Amis Blog talks about writable external tables - 04/05/2005 by 04/05/2005
- SearchOracle has an excellent Oracle security links page - 04/06/2005 by 04/06/2005
- Alex Kornbrust has a new paper on google hacking and Oracle - 04/08/2005 by 04/08/2005
- An interesting post by Mark - 04/09/2005 by 04/09/2005
- O'Reilly CodeZoo - 04/11/2005 by 04/11/2005
- CPU April 12 - 2005 is released - 04/12/2005 by 04/12/2005
- InternetNews.com has a news item about CPU 2 - 04/13/2005 by 04/13/2005
- CPU 12 April researchers advisories - 04/14/2005 by 04/14/2005
- Another interesting Oracle-l thread on Oracle security auditing - 04/15/2005 by 04/15/2005
- Another news item about CPU 12 April - 04/16/2005 by 04/16/2005
- Interesting analysis of CPU 12 April - "To patch or not to patch" - 04/17/2005 by 04/17/2005
- Esteban Martínez Fayó releases his security advisories for CPU 12 April - 04/18/2005 by 04/18/2005
- Frank has a good review of a secure coding book - 04/19/2005 by 04/19/2005
- Tom Kyte has started a blog - 04/20/2005 by 04/20/2005
- Frank has a nice document recommendations - 04/22/2005 by 04/22/2005
- Some updated links on my Oracle security papers page - 04/23/2005 by 04/23/2005
- View privileges - 04/25/2005 by 04/25/2005
- A new paper on Oracle database passwords - 04/26/2005 by 04/26/2005
- Mark Coleman talks about Oracle and SOX compliance - 04/27/2005 by 04/27/2005
- Ed also talked about Tom and direct dictionary editing - 04/28/2005 by 04/28/2005
- Mark has a post about Oracle's talks to buy Siebel - 04/29/2005 by 04/29/2005
- Alex has added an Oracle exploits page to his site - 04/30/2005 by 04/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
