CIA RESEARCH
Alerts
[CIA-1029-Alert] Oracle Reports XML File Access via “customize” parameter
Summary:
A vulnerability in Oracle Reports allows a remote attacker to read fragments of
arbitrary XML files on the Reports server.
Technical Details:
A remote user can submit a special type of web request via the ‘customize’ parameter
and view fragments of any XML file on the reports server. The file information
is disclosed in verbose error messages that contain part of the contents of the requested
file.
A demonstration exploit URI is provided:
http://OracleReportsServer:7778/reports/rwservlet?
server=myserver+report=test.rdf+userid=joeuser/
penetrate@haxordb+destype=cache+
desformat=xml+CUSTOMIZE=/opt/
ORACLE/ias/oracle/product/9.0.2/webcache/
webcache.xml
Solution:
An unofficial workaround is described at:
Red Database Security: Oracle Reports Read Any XML File
Additionally, customers using Oracle products should apply Critical Patch update
for July 2005. The vulnerability discussed in this alert is not fixed by the
critical patch update, however, the critical patch update does address other
high risk security issues.
http://www.oracle.com/technology/deploy/security/pdf/
cpujul2005.html
CVE Reference:
GENERIC-MAP-NOMATCH
SecurityTracker Number(s):
1014525
Vendor URL:
Oracle
About the Cenzic CIA Team:
Cenzic Intelligent Analysis (CIA) is Cenzic’s research arm that focuses on continuous
research for application vulnerabilities. Industry Research, Vulnerability assessment,
penetration testing, and security testing — that’s what Cenzic Intelligent Analysis
Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing
research to find not only common vulnerabilities but also vulnerabilities found in
customer applications and make them available to our customers and to the community at large.
About Cenzic:
Cenzic provides Hailstorm®, the revolutionary enterprise software suite for automated
application security assessment and compliance that allows corporations and government
organizations to dramatically improve the security of commercial and custom applications.
Hailstorm enables security experts, QA professionals, and developers to work together
to assess, analyze, and remediate applications for security vulnerabilities, and verify
compliance with security policies. Benefits include reduced security risk and liability,
lower development and testing costs, and faster time-to-market. Cenzic’s customers are
currently in the financial services and
e-marketplaces sectors. For more information
visit www.cenzic.com or call 1-866-4-CENZIC
|
