57 lines
No EOL
2.4 KiB
Text
57 lines
No EOL
2.4 KiB
Text
Oracle E-Business Suite is prone to multiple authentication-bypass and HTML-injection vulnerabilities.
|
|
|
|
Attackers could exploit these issues to steal cookie-based authentication credentials, perform unauthorized actions, or bypass certain security restrictions. Other attacks are also possible.
|
|
|
|
Some of these vulnerabilities may be documented in BID 33177 (Oracle January 2009 Critical Patch Update Multiple Vulnerabilities). Reportedly, the HTML-injection and some authentication-bypass vulnerabilities were addressed in the Oracle January 2009 Critical Patch Update. Full details are not currently available. We will update this BID as more information emerges.
|
|
|
|
Oracle E-Business Suite 10 and 11 are vulnerable; other versions may also be affected.
|
|
|
|
Bugtraq ID: 37305
|
|
Class: Unknown
|
|
CVE:
|
|
Remote: Yes
|
|
Local: No
|
|
Published: Dec 14 2009 12:00AM
|
|
Updated: Dec 14 2009 10:13PM
|
|
Credit: Hacktics (Shay Chen, Gil Cohen, and Oren Hafif)
|
|
Vulnerable: Oracle E-Business Suite 11i 11.8
|
|
Oracle E-Business Suite 11i 11.7
|
|
Oracle E-Business Suite 11i 11.6
|
|
Oracle E-Business Suite 11i 11.5.10 CU2
|
|
Oracle E-Business Suite 11i 11.5.10
|
|
Oracle E-Business Suite 11i 11.5.9
|
|
Oracle E-Business Suite 11i 11.5.8
|
|
Oracle E-Business Suite 11i 11.5.7
|
|
Oracle E-Business Suite 11i 11.5.6
|
|
Oracle E-Business Suite 11i 11.5.5
|
|
Oracle E-Business Suite 11i 11.5.4
|
|
Oracle E-Business Suite 11i 11.5.3
|
|
Oracle E-Business Suite 11i 11.5.2
|
|
Oracle E-Business Suite 11i 11.5.1
|
|
Oracle E-Business Suite 11i 11.5
|
|
Oracle E-Business Suite 11i 11.4
|
|
Oracle E-Business Suite 11i 11.3
|
|
Oracle E-Business Suite 11i 11.2
|
|
Oracle E-Business Suite 11i 11.1
|
|
Oracle E-Business Suite 11i 11.5.10.2
|
|
Oracle E-Business Suite 11.0
|
|
Oracle E-Business Suite 10.7
|
|
|
|
An attacker can use a browser to exploit these issues.
|
|
|
|
The following example URIs are available:
|
|
|
|
Authentication bypass:
|
|
|
|
http://server:port/OA_HTML/OA.jsp
|
|
http://server:port/OA_HTML/RF.jsp
|
|
http://server:port/pls/[DADName]/oracleconfigure.customize?p_page_id=[page_id]
|
|
http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id]
|
|
http://server:8888/pls/TEST/oracleconfigure.customize?p_page_id=1
|
|
|
|
HTML injection:
|
|
|
|
http://server:port/pls/[DADName]/icx_define_pages.editpagelist
|
|
http://server:port/pls/[DADName]/oracleconfigure.customize?p_page_id=[page_id]
|
|
http://www.example.com:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id]
|
|
http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=CREATE |