full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] Team SHATTER Security Advi

[Full-disclosure] Team SHATTER Security Advisory: Cross-site scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter)

From: Team SHATTER <shatter_at_nospam>
Date: Mon Aug 04 2008 - 16:43:27 GMT
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk


Hash: SHA1

Team SHATTER Security Advisory

Cross-site scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter)

August 4, 2008

Risk Level:

Affected versions:
Oracle Enterprise Manager Database Control 10gR1, 10gR2 and 11g (

Remote exploitable:

This vulnerability was discovered and researched by Esteban Martínez Fayó of Application Security Inc.

Cross-site scripting vulnerabilities occur when an attacker tricks a legitimate web application into sending malicious code, generally in the form of a script, to an unsuspecting end user. The attack usually involves crafting a hyperlink with malicious script code embedded within it. A valid user is likely to click this link since it points to a resource on a trusted domain. The link can be posted on a web page, or sent in an instant message, or email. Clicking on the link executes the attacker-injected code in the context of the trusted web application. Typically, the code steals session cookies, which can then be used to impersonate a valid user.
The "REFRESHCHOICE" parameter used in web pages of Oracle Enterprise Manager are vulnerable to cross-site scripting attacks. User supplied input to these parameters is returned without proper sanitization, allowing a malicious attacker to inject arbitrary scripting code.

Attackers might steal administrator's session cookies, thereby allowing the attacker to impersonate the valid user.

Vendor Status:
Vendor was contacted and a patch was released.

There is no workaround for this issue.

Apply Oracle Critical Patch Update July 2008 available at Oracle Metalink.

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2008.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2603

Vendor Notification - 12/27/2007
Vendor Response - 12/27/2007
Fix - 7/15/2008
Public Disclosure - 7/23/2008

Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkiXMa8ACgkQ9EOAcmTuFN33twCfV6yidpr9eAmIbhvBTyY07uE6 RVIAoLKVCD5lsBM0IyksviVGbrhu1tlF

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/