Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: XSS in Oracle default fcgi-bin/echo
From: paul.szabo () sydney edu au
Date: Thu, 14 Oct 2010 07:49:01 +1100

Dear Thor,

Hmm... maybe difficult to verify, since I did not post a PoC test.
Maybe a kind Oracle admin could point me to a patched fcgi-bin/echo?
Funny if any such existed: an admin careful to keep patches up-to-date, but
careless in not following security recommendations to remove...
Maybe, contact me off-list so I can provide PoC?

If you are going to give PoC code to anyone who asks for it, why not
just post it?   It will be made public anyway.  Or you could apply the
patch yourself and test on your own and communicate any vulnerabilities
that my persist to Oracle first.

You make wrong assumptions, and jump to conclusions:
 - Not anyone, but bona-fide ones only.
 - I do not "own" an Oracle site to test.
Were not those obvious to right-thinking people?

Cheers, Paul

Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]