|
Products
Repscan 2008
PLSQL-Scanner
Hedgehog Enterpise
Checkpwd (free)
Services
Oracle Audit / Hardening
Security Training
Consulting
Information
Published Alerts
Upcoming Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Videos 
Scripts
News & Events
Events
News
Company
Blog
Contact
People
Partner
Impressum
Sitemap
Search
|
Cross-Site-Scripting Vulnerability in Oracle XMLDB
| Name |
Cross-Site-Scripting Vulnerability in Oracle XMLDB |
| Systems Affected |
Oracle Database 9i Rel. 2 |
| Severity |
Low Risk |
| Category |
Cross Site Scripting (CSS/XSS) |
| Vendor URL |
http://www.oracle.com/ |
| Author |
Alexander Kornbrust (ak at red-database-security.com) |
| Date |
7 October 2005 (V 1.00) |
Details
Oracle XML DB is a feature of the Oracle Database.
It provides a high-performance, native XML
retrieval and storage technology.
It fully absorbs the W3C XML data model into the Oracle Database,
and provides new standard access methods for navigating and querying XML.
Oracle XML DB is vulnerable against cross site scripting.
Affected Products
Oracle Database 9i Release 2
Patch Information
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005.
Testcase
http://scott:tiger@myserver:8080/oradb<script>alert('Hi')</script>/SCOTT/EMP
History
9-oct-2003 Oracle secalert was informed
10-oct-2003 Bug confirmed
12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed.
07-oct-2005 Red-Database-Security published this advisory
© 2005 by Red-Database-Security GmbH - last update 03-nov-2005
|
Oracle XMLDB
Oracle XML DB is a feature of the Oracle Database. It provides a high-performance,
native XML storage and retrieval technology. It fully absorbs the W3C
XML data model into the Oracle Database, and provides new standard access methods for navigating
and querying XML. With Oracle XML DB, you get all the advantages
of relational database technology plus the advantages of XML.
Oracle XML DB is available since Oracle 9i Release 2.
Oracle installs a HTTP and FTP listener in the database running on port 8080/2100.
Since Oracle 10g Rel. 2 there is also a HTTPS listener available.
|
