Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
Cross-Site-Scripting Vulnerability in Oracle XMLDB (DB06)

Name Cross-Site-Scripting Vulnerability in Oracle XMLDB
Systems Affected Oracle Database 9i Rel. 2
Severity Low Risk
Category Cross Site Scripting (CSS/XSS)
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
Date 16 January 2007 (V 1.00)
Time to fix 1221 days


Details
Oracle XML DB is a feature of the Oracle Database. It provides a high-performance, native XML retrieval and storage technology.
It fully absorbs the W3C XML data model into the Oracle Database, and provides new standard access methods for navigating and querying XML.

Oracle XML DB is vulnerable against cross site scripting. Red-Database-Security reported this bug 2003 and now 2007 Oracle fixed the problem

Affected Products
Oracle Database 9i Release 2

Patch Information
This bug is fixed with Critical Patch Update January 2007.


History
13-sep-2003 Oracle secalert was informed
14-sep-2003 Bug confirmed
16-jan-2007 Oracle published CPU January 2007 [DB06]
16-jan-2007 Red-Database-Security published this advisory



2007 by Red-Database-Security GmbH - last update 16-jan-2007

Oracle XMLDB

Oracle XML DB is a feature of the Oracle Database. It provides a high-performance,
native XML storage and retrieval technology. It fully absorbs the W3C
XML data model into the Oracle Database, and provides new standard access methods for navigating
and querying XML. With Oracle XML DB, you get all the advantages
of relational database technology plus the advantages of XML.
Oracle XML DB is available since Oracle 9i Release 2.

Oracle installs a HTTP and FTP listener in the database running on port 8080/2100.