Vulnerabilities > CVE-2007-0275 - Cross-site Scripting vulnerability in Oracle products

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
oracle
CWE-79
nessus
NVD
Published: 2007-01-17
Updated: 2018-10-16

Summary

Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.

Vulnerable Configurations

Part Description Count
Application
Oracle
8

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

  • NASL familyWeb Servers
    NASL idORACLE_APPLICATION_SERVER_PCI.NASL
    descriptionThe remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities : - CVE-2000-0169: Remote command execution in the web listener component. - CVE-2000-1235: Information disclosure in the port listener component and modplsql. - CVE-2000-1236: SQL injection in mod_sql. - CVE-2001-0326: Information disclosure in the Java Virtual Machine. - CVE-2001-0419: Buffer overflow in ndwfn4.so. - CVE-2001-0591: Directory traversal. - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module. - CVE-2001-1217: Directory traversal vulnerability in the PL/SQL Apache module. - CVE-2001-1371: Improper access control in the SOAP service. - CVE-2001-1372: Information disclosure. - CVE-2002-0386: Denial of service through the administration module for Oracle Web Cache. - CVE-2002-0559: Buffer overflows in the PL/SQL module. - CVE-2002-0560: Information disclosure in the PL/SQL module. - CVE-2002-0561: Authentication bypass in the PL/SQL Gateway web administration interface. - CVE-2002-0562: Information disclosure through globals.jsa. - CVE-2002-0563: Improper access control on several services. - CVE-2002-0564: Authentication bypass in the PL/SQL module. - CVE-2002-0565: Information disclosure through JSP files in the _pages directory. - CVE-2002-0566: Denial of service in the PL/SQL module. - CVE-2002-0568: Improper access control on XSQLConfig.xml and soapConfig.xml. - CVE-2002-0569: Authentication bypass through XSQLServlet. - CVE-2002-0655: Denial of service in OpenSSL. - CVE-2002-0656: Buffer overflows in OpenSSL. - CVE-2002-0659: Denial of service in OpenSSL. - CVE-2002-0840: Cross-site scripting in the default error page of Apache. - CVE-2002-0842: Format string vulnerability in mod_dav. - CVE-2002-0843: Buffer overflows in ApacheBench. - CVE-2002-0947: Buffer overflow in rwcgi60. - CVE-2002-1089: Information disclosure in rwcgi60. - CVE-2002-1630: Improper access control on sendmail.jsp. - CVE-2002-1631: SQL injection in query.xsql. - CVE-2002-1632: Information disclosure through several JSP pages. - CVE-2002-1635: Information disclosure in Apache. - CVE-2002-1636: Cross-site scripting in the htp PL/SQL package. - CVE-2002-1637: Default credentials in multiple components. - CVE-2002-1858: Information disclosure through the WEB-INF directory. - CVE-2002-2153: Format string vulnerability in the administrative pages of the PL/SQL module. - CVE-2002-2345: Credential leakage in the web cache administrator interface. - CVE-2002-2347: Cross-site scripting in several JSP pages. - CVE-2004-1362: Authentication bypass in the PL/SQL module. - CVE-2004-1363: Buffer overflow in extproc. - CVE-2004-1364: Directory traversal in extproc. - CVE-2004-1365: Command execution in extproc. - CVE-2004-1366: Improper access control on emoms.properties. - CVE-2004-1367: Credential leakage in Database Server. - CVE-2004-1368: Arbitrary file execution in ISQL*Plus. - CVE-2004-1369: Denial of service in TNS Listener. - CVE-2004-1370: Multiple SQL injection vulnerabilities in PL/SQL. - CVE-2004-1371: Stack-based buffer overflow. - CVE-2004-1707: Privilege escalation in dbsnmp and nmo. - CVE-2004-1774: Buffer overflow in the MD2 package. - CVE-2004-1877: Phishing vulnerability in Single Sign-On component. - CVE-2004-2134: Weak cryptography for passwords in the toplink mapping workBench. - CVE-2004-2244: Denial of service in the XML parser. - CVE-2005-1383: Authentication bypass in HTTP Server. - CVE-2005-1495: Detection bypass. - CVE-2005-1496: Privilege escalation in the DBMS_Scheduler. - CVE-2005-2093: Web cache poisoning. - CVE-2005-3204: Cross-site scripting. - CVE-2005-3445: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2005-3446: Unspecified vulnerability in Internet Directory. - CVE-2005-3447: Unspecified vulnerability in Single Sign-On. - CVE-2005-3448: Unspecified vulnerability in the OC4J module. - CVE-2005-3449: Multiple unspecified vulnerabilities in multiple components. - CVE-2005-3450: Unspecified vulnerability in HTTP Server. - CVE-2005-3451: Unspecified vulnerability in SQL*ReportWriter. - CVE-2005-3452: Unspecified vulnerability in Web Cache. - CVE-2005-3453: Multiple unspecified vulnerabilities in Web Cache. - CVE-2006-0273: Unspecified vulnerability in the Portal component. - CVE-2006-0274: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0275: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0282: Unspecified vulnerability. - CVE-2006-0283: Unspecified vulnerability. - CVE-2006-0284: Multiple unspecified vulnerabilities. - CVE-2006-0285: Unspecified vulnerability in the Java Net component. - CVE-2006-0286: Unspecified vulnerability in HTTP Server. - CVE-2006-0287: Unspecified vulnerability in HTTP Server. - CVE-2006-0288: Multiple unspecified vulnerabilities in the Oracle Reports Developer component. - CVE-2006-0289: Multiple unspecified vulnerabilities. - CVE-2006-0290: Unspecified vulnerability in the Oracle Workflow Cartridge component. - CVE-2006-0291: Multiple unspecified vulnerabilities in the Oracle Workflow Cartridge component. - CVE-2006-0435: Unspecified vulnerability in Oracle PL/SQL. - CVE-2006-0552: Unspecified vulnerability in the Net Listener component. - CVE-2006-0586: Multiple SQL injection vulnerabilities. - CVE-2006-1884: Unspecified vulnerability in the Oracle Thesaurus Management System component. - CVE-2006-3706: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3707: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3708: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3709: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3710: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3711: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3712: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3713: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3714: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5353: Unspecified vulnerability in HTTP Server. - CVE-2006-5354: Unspecified vulnerability in HTTP Server. - CVE-2006-5355: Unspecified vulnerability in Single Sign-On. - CVE-2006-5356: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5357: Unspecified vulnerability in HTTP Server. - CVE-2006-5358: Unspecified vulnerability in the Oracle Forms component. - CVE-2006-5359: Multiple unspecified vulnerabilities in Oracle Reports Developer component. - CVE-2006-5360: Unspecified vulnerability in Oracle Forms component. - CVE-2006-5361: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5362: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5363: Unspecified vulnerability in Single Sign-On. - CVE-2006-5364: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5365: Unspecified vulnerability in Oracle Forms. - CVE-2006-5366: Multiple unspecified vulnerabilities. - CVE-2007-0222: Directory traversal vulnerability in EmChartBean. - CVE-2007-0275: Cross-site scripting vulnerability in Oracle Reports Web Cartridge (RWCGI60). - CVE-2007-0280: Buffer overflow in Oracle Notification Service. - CVE-2007-0281: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2007-0282: Unspecified vulnerability in OPMN02. - CVE-2007-0283: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0284: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-0285: Unspecified vulnerability in Oracle Reports Developer. - CVE-2007-0286: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0287: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0288: Unspecified vulnerability in Oracle Internet Directory. - CVE-2007-0289: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-1359: Improper access control in mod_security. - CVE-2007-1609: Cross-site scripting vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS). - CVE-2007-2119: Cross-site scripting vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. - CVE-2007-2120: Denial of service in the Oracle Discoverer servlet. - CVE-2007-2121: Unspecified vulnerability in the COREid Access component. - CVE-2007-2122: Unspecified vulnerability in the Wireless component. - CVE-2007-2123: Unspecified vulnerability in the Portal component. - CVE-2007-2124: Unspecified vulnerability in the Portal component. - CVE-2007-2130: Unspecified vulnerability in Workflow Cartridge. - CVE-2007-3553: Cross-site scripting vulnerability in Rapid Install Web Server. - CVE-2007-3854: Multiple unspecified vulnerabilities in the Advanced Queuing component and the Spatial component. - CVE-2007-3859: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-3861: Unspecified vulnerability in Oracle Jdeveloper. - CVE-2007-3862: Unspecified vulnerability in Single Sign-On. - CVE-2007-3863: Unspecified vulnerability in Oracle JDeveloper. - CVE-2007-5516: Unspecified vulnerability in the Oracle Process Mgmt & Notification component. - CVE-2007-5517: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5518: Unspecified vulnerability in HTTP Server. - CVE-2007-5519: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5520: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5521: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-5522: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5523: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5524: Unspecified vulnerability in Single Sign-On. - CVE-2007-5525: Unspecified vulnerability in Single Sign-On. - CVE-2007-5526: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5531: Unspecified vulnerability in Oracle Help for Web. - CVE-2008-0340: Multiple unspecified vulnerabilities in the Advanced Queuing component and Spatial component. - CVE-2008-0343: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0344: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0345: Unspecified vulnerability in the Core RDBMS component. - CVE-2008-0346: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-0347: Unspecified vulnerability in the Oracle Ultra Search component. - CVE-2008-0348: Multiple unspecified vulnerabilities in the PeopleTools component. - CVE-2008-0349: Unspecified vulnerability in the PeopleTools component. - CVE-2008-1812: Unspecified vulnerability in the Oracle Enterprise Manager component. - CVE-2008-1814: Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component. - CVE-2008-1823: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-1824: Unspecified vulnerability in the Oracle Dynamic Monitoring Service component. - CVE-2008-1825: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2583: Unspecified vulnerability in the sample Discussion Forum Portlet for the Oracle Portal component. - CVE-2008-2588: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-2589: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2593: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2594: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2595: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2008-2609: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2612: Unspecified vulnerability in the Hyperion BI Plus component. - CVE-2008-2614: Unspecified vulnerability in HTTP Server. - CVE-2008-2619: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2008-2623: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-3975: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3977: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3986: Unspecified vulnerability in the Oracle Discoverer Administrator component. - CVE-2008-3987: Unspecified vulnerability in the Oracle Discoverer Desktop component. - CVE-2008-4014: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2008-4017: Unspecified vulnerability in the OC4J component. - CVE-2008-5438: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-7233: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2009-0217: Signature spoofing vulnerability in multiple components. - CVE-2009-0989: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0990: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0994: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1008: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1009: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1010: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1011: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1017: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1976: Unspecified vulnerability in HTTP Server. - CVE-2009-1990: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-1999: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-3407: Unspecified vulnerability in the Portal component. - CVE-2009-3412: Unspecified vulnerability in the Unzip component. - CVE-2010-0066: Unspecified vulnerability in the Access Manager Identity Server component. - CVE-2010-0067: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2010-0070: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-0789: Unspecified vulnerability in HTTP Server. - CVE-2011-0795: Unspecified vulnerability in Single Sign-On. - CVE-2011-0884: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2011-2237: Unspecified vulnerability in the Oracle Web Services Manager component. - CVE-2011-2314: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-3523: Unspecified vulnerability in the Oracle Web Services Manager component.
    last seen2020-06-01
    modified2020-06-02
    plugin id57619
    published2012-01-24
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/57619
    titleOracle Application Server Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57619);
  script_version("1.23");
  script_cvs_date("Date: 2019/04/05 15:04:42");

  script_cve_id(
    "CVE-2000-0169",
    "CVE-2000-1235",
    "CVE-2000-1236",
    "CVE-2001-0326",
    "CVE-2001-0419",
    "CVE-2001-0591",
    "CVE-2001-1216",
    "CVE-2001-1217",
    "CVE-2001-1371",
    "CVE-2001-1372",
    "CVE-2002-0386",
    "CVE-2002-0559",
    "CVE-2002-0560",
    "CVE-2002-0561",
    "CVE-2002-0562",
    "CVE-2002-0563",
    "CVE-2002-0564",
    "CVE-2002-0565",
    "CVE-2002-0566",
    "CVE-2002-0568",
    "CVE-2002-0569",
    "CVE-2002-0655",
    "CVE-2002-0656",
    "CVE-2002-0659",
    "CVE-2002-0840",
    "CVE-2002-0842",
    "CVE-2002-0843",
    "CVE-2002-0947",
    "CVE-2002-1089",
    "CVE-2002-1630",
    "CVE-2002-1631",
    "CVE-2002-1632",
    "CVE-2002-1635",
    "CVE-2002-1636",
    "CVE-2002-1637",
    "CVE-2002-1858",
    "CVE-2002-2153",
    "CVE-2002-2345",
    "CVE-2002-2347",
    "CVE-2004-1362",
    "CVE-2004-1363",
    "CVE-2004-1364",
    "CVE-2004-1365",
    "CVE-2004-1366",
    "CVE-2004-1367",
    "CVE-2004-1368",
    "CVE-2004-1369",
    "CVE-2004-1370",
    "CVE-2004-1371",
    "CVE-2004-1707",
    "CVE-2004-1774",
    "CVE-2004-1877",
    "CVE-2004-2134",
    "CVE-2004-2244",
    "CVE-2005-1383",
    "CVE-2005-1495",
    "CVE-2005-1496",
    "CVE-2005-2093",
    "CVE-2005-3204",
    "CVE-2005-3445",
    "CVE-2005-3446",
    "CVE-2005-3447",
    "CVE-2005-3448",
    "CVE-2005-3449",
    "CVE-2005-3450",
    "CVE-2005-3451",
    "CVE-2005-3452",
    "CVE-2005-3453",
    "CVE-2006-0273",
    "CVE-2006-0274",
    "CVE-2006-0275",
    "CVE-2006-0282",
    "CVE-2006-0283",
    "CVE-2006-0284",
    "CVE-2006-0285",
    "CVE-2006-0286",
    "CVE-2006-0287",
    "CVE-2006-0288",
    "CVE-2006-0289",
    "CVE-2006-0290",
    "CVE-2006-0291",
    "CVE-2006-0435",
    "CVE-2006-0552",
    "CVE-2006-0586",
    "CVE-2006-1884",
    "CVE-2006-3706",
    "CVE-2006-3707",
    "CVE-2006-3708",
    "CVE-2006-3709",
    "CVE-2006-3710",
    "CVE-2006-3711",
    "CVE-2006-3712",
    "CVE-2006-3713",
    "CVE-2006-3714",
    "CVE-2006-5353",
    "CVE-2006-5354",
    "CVE-2006-5355",
    "CVE-2006-5356",
    "CVE-2006-5357",
    "CVE-2006-5358",
    "CVE-2006-5359",
    "CVE-2006-5360",
    "CVE-2006-5361",
    "CVE-2006-5362",
    "CVE-2006-5363",
    "CVE-2006-5364",
    "CVE-2006-5365",
    "CVE-2006-5366",
    "CVE-2007-0222",
    "CVE-2007-0275",
    "CVE-2007-0280",
    "CVE-2007-0281",
    "CVE-2007-0282",
    "CVE-2007-0283",
    "CVE-2007-0284",
    "CVE-2007-0285",
    "CVE-2007-0286",
    "CVE-2007-0287",
    "CVE-2007-0288",
    "CVE-2007-0289",
    "CVE-2007-1359",
    "CVE-2007-1609",
    "CVE-2007-2119",
    "CVE-2007-2120",
    "CVE-2007-2121",
    "CVE-2007-2122",
    "CVE-2007-2123",
    "CVE-2007-2124",
    "CVE-2007-2130",
    "CVE-2007-3553",
    "CVE-2007-3854",
    "CVE-2007-3859",
    "CVE-2007-3861",
    "CVE-2007-3862",
    "CVE-2007-3863",
    "CVE-2007-5516",
    "CVE-2007-5517",
    "CVE-2007-5518",
    "CVE-2007-5519",
    "CVE-2007-5520",
    "CVE-2007-5521",
    "CVE-2007-5522",
    "CVE-2007-5523",
    "CVE-2007-5524",
    "CVE-2007-5525",
    "CVE-2007-5526",
    "CVE-2007-5531",
    "CVE-2008-0340",
    "CVE-2008-0343",
    "CVE-2008-0344",
    "CVE-2008-0345",
    "CVE-2008-0346",
    "CVE-2008-0347",
    "CVE-2008-0348",
    "CVE-2008-0349",
    "CVE-2008-1812",
    "CVE-2008-1814",
    "CVE-2008-1823",
    "CVE-2008-1824",
    "CVE-2008-1825",
    "CVE-2008-2583",
    "CVE-2008-2588",
    "CVE-2008-2589",
    "CVE-2008-2593",
    "CVE-2008-2594",
    "CVE-2008-2595",
    "CVE-2008-2609",
    "CVE-2008-2612",
    "CVE-2008-2614",
    "CVE-2008-2619",
    "CVE-2008-2623",
    "CVE-2008-3975",
    "CVE-2008-3977",
    "CVE-2008-3986",
    "CVE-2008-3987",
    "CVE-2008-4014",
    "CVE-2008-4017",
    "CVE-2008-5438",
    "CVE-2008-7233",
    "CVE-2009-0217",
    "CVE-2009-0989",
    "CVE-2009-0990",
    "CVE-2009-0994",
    "CVE-2009-1008",
    "CVE-2009-1009",
    "CVE-2009-1010",
    "CVE-2009-1011",
    "CVE-2009-1017",
    "CVE-2009-1976",
    "CVE-2009-1990",
    "CVE-2009-1999",
    "CVE-2009-3407",
    "CVE-2009-3412",
    "CVE-2010-0066",
    "CVE-2010-0067",
    "CVE-2010-0070",
    "CVE-2011-0789",
    "CVE-2011-0795",
    "CVE-2011-0884",
    "CVE-2011-2237",
    "CVE-2011-2314",
    "CVE-2011-3523"
  );

  script_bugtraq_id(
    1053,
    2150,
    2286,
    2569,
    3341,
    3726,
    3727,
    4032,
    4034,
    4037,
    4289,
    4290,
    4292,
    4293,
    4294,
    4298,
    4844,
    4848,
    5119,
    5262,
    5362,
    5363,
    5364,
    5366,
    5452,
    5847,
    5887,
    5902,
    5995,
    5996,
    6556,
    6846,
    7395,
    9515,
    9703,
    10009,
    10829,
    10871,
    13145,
    13418,
    13509,
    15034,
    15134,
    16287,
    16294,
    16384,
    17590,
    19054,
    20588,
    22027,
    22083,
    22831,
    23102,
    23532,
    24697,
    27229,
    33177,
    34461,
    35671,
    35688,
    36746,
    36749,
    36753,
    50202,
    50209
  );

  script_name(english:"Oracle Application Server Multiple Vulnerabilities");
  script_summary(english:"Checks version in Server response header.");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server may be affected by multiple vulnerabilities.");
 script_set_attribute(attribute:"description", value:
"The remote host is running Oracle Application Server. It was not possible
to determine its version, so the version of Oracle Application Server
installed on the remote host could potentially be affected by multiple
vulnerabilities :

  - CVE-2000-0169: Remote command execution in the web
    listener component.

  - CVE-2000-1235: Information disclosure in the port
    listener component and modplsql.

  - CVE-2000-1236: SQL injection in mod_sql.

  - CVE-2001-0326: Information disclosure in the Java
    Virtual Machine.

  - CVE-2001-0419: Buffer overflow in ndwfn4.so.

  - CVE-2001-0591: Directory traversal.

  - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.

  - CVE-2001-1217: Directory traversal vulnerability in the
    PL/SQL Apache module.

  - CVE-2001-1371: Improper access control in the SOAP
    service.

  - CVE-2001-1372: Information disclosure.

  - CVE-2002-0386: Denial of service through the
    administration module for Oracle Web Cache.

  - CVE-2002-0559: Buffer overflows in the PL/SQL module.

  - CVE-2002-0560: Information disclosure in the PL/SQL
    module.

  - CVE-2002-0561: Authentication bypass in the PL/SQL
    Gateway web administration interface.

  - CVE-2002-0562: Information disclosure through
    globals.jsa.

  - CVE-2002-0563: Improper access control on several
    services.

  - CVE-2002-0564: Authentication bypass in the PL/SQL
    module.

  - CVE-2002-0565: Information disclosure through JSP files
    in the _pages directory.

  - CVE-2002-0566: Denial of service in the PL/SQL module.

  - CVE-2002-0568: Improper access control on XSQLConfig.xml
    and soapConfig.xml.

  - CVE-2002-0569: Authentication bypass through
    XSQLServlet.

  - CVE-2002-0655: Denial of service in OpenSSL.

  - CVE-2002-0656: Buffer overflows in OpenSSL.

  - CVE-2002-0659: Denial of service in OpenSSL.

  - CVE-2002-0840: Cross-site scripting in the default error
    page of Apache.

  - CVE-2002-0842: Format string vulnerability in mod_dav.

  - CVE-2002-0843: Buffer overflows in ApacheBench.

  - CVE-2002-0947: Buffer overflow in rwcgi60.

  - CVE-2002-1089: Information disclosure in rwcgi60.

  - CVE-2002-1630: Improper access control on sendmail.jsp.

  - CVE-2002-1631: SQL injection in query.xsql.

  - CVE-2002-1632: Information disclosure through several
    JSP pages.

  - CVE-2002-1635: Information disclosure in Apache.

  - CVE-2002-1636: Cross-site scripting in the htp PL/SQL
    package.

  - CVE-2002-1637: Default credentials in multiple
    components.

  - CVE-2002-1858: Information disclosure through the
    WEB-INF directory.

  - CVE-2002-2153: Format string vulnerability in the
    administrative pages of the PL/SQL module.

  - CVE-2002-2345: Credential leakage in the web cache
    administrator interface.

  - CVE-2002-2347: Cross-site scripting in several JSP
    pages.

  - CVE-2004-1362: Authentication bypass in the PL/SQL
    module.

  - CVE-2004-1363: Buffer overflow in extproc.

  - CVE-2004-1364: Directory traversal in extproc.

  - CVE-2004-1365: Command execution in extproc.

  - CVE-2004-1366: Improper access control on
    emoms.properties.

  - CVE-2004-1367: Credential leakage in Database Server.

  - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.

  - CVE-2004-1369: Denial of service in TNS Listener.

  - CVE-2004-1370: Multiple SQL injection vulnerabilities in
    PL/SQL.

  - CVE-2004-1371: Stack-based buffer overflow.

  - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.

  - CVE-2004-1774: Buffer overflow in the MD2 package.

  - CVE-2004-1877: Phishing vulnerability in Single Sign-On
    component.

  - CVE-2004-2134: Weak cryptography for passwords in the
    toplink mapping workBench.

  - CVE-2004-2244: Denial of service in the XML parser.

  - CVE-2005-1383: Authentication bypass in HTTP Server.

  - CVE-2005-1495: Detection bypass.

  - CVE-2005-1496: Privilege escalation in the
    DBMS_Scheduler.

  - CVE-2005-2093: Web cache poisoning.

  - CVE-2005-3204: Cross-site scripting.

  - CVE-2005-3445: Multiple unspecified vulnerabilities in
    HTTP Server.

  - CVE-2005-3446: Unspecified vulnerability in Internet
    Directory.

  - CVE-2005-3447: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2005-3448: Unspecified vulnerability in the OC4J
    module.

  - CVE-2005-3449: Multiple unspecified vulnerabilities in
    multiple components.

  - CVE-2005-3450: Unspecified vulnerability in HTTP Server.

  - CVE-2005-3451: Unspecified vulnerability in
    SQL*ReportWriter.

  - CVE-2005-3452: Unspecified vulnerability in Web Cache.

  - CVE-2005-3453: Multiple unspecified vulnerabilities in
    Web Cache.

  - CVE-2006-0273: Unspecified vulnerability in the Portal
    component.

  - CVE-2006-0274: Unspecified vulnerability in the Oracle
    Reports Developer component.

  - CVE-2006-0275: Unspecified vulnerability in the Oracle
    Reports Developer component.

  - CVE-2006-0282: Unspecified vulnerability.

  - CVE-2006-0283: Unspecified vulnerability.

  - CVE-2006-0284: Multiple unspecified vulnerabilities.

  - CVE-2006-0285: Unspecified vulnerability in the Java Net
    component.

  - CVE-2006-0286: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0287: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0288: Multiple unspecified vulnerabilities in
    the Oracle Reports Developer component.

  - CVE-2006-0289: Multiple unspecified vulnerabilities.

  - CVE-2006-0290: Unspecified vulnerability in the Oracle
    Workflow Cartridge component.

  - CVE-2006-0291: Multiple unspecified vulnerabilities in
    the Oracle Workflow Cartridge component.

  - CVE-2006-0435: Unspecified vulnerability in Oracle
    PL/SQL.

  - CVE-2006-0552: Unspecified vulnerability in the Net
    Listener component.

  - CVE-2006-0586: Multiple SQL injection vulnerabilities.

  - CVE-2006-1884: Unspecified vulnerability in the Oracle
    Thesaurus Management System component.

  - CVE-2006-3706: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3707: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3708: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3709: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3710: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3711: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3712: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3713: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-3714: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-5353: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5354: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5355: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2006-5356: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-5357: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5358: Unspecified vulnerability in the Oracle
    Forms component.

  - CVE-2006-5359: Multiple unspecified vulnerabilities in
    Oracle Reports Developer component.

  - CVE-2006-5360: Unspecified vulnerability in Oracle Forms
    component.

  - CVE-2006-5361: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-5362: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-5363: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2006-5364: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2006-5365: Unspecified vulnerability in Oracle
    Forms.

  - CVE-2006-5366: Multiple unspecified vulnerabilities.

  - CVE-2007-0222: Directory traversal vulnerability in
    EmChartBean.

  - CVE-2007-0275: Cross-site scripting vulnerability in
    Oracle Reports Web Cartridge (RWCGI60).

  - CVE-2007-0280: Buffer overflow in Oracle Notification
    Service.

  - CVE-2007-0281: Multiple unspecified vulnerabilities in
    HTTP Server.

  - CVE-2007-0282: Unspecified vulnerability in OPMN02.

  - CVE-2007-0283: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2007-0284: Multiple unspecified vulnerabilities in
    Oracle Containers for J2EE.

  - CVE-2007-0285: Unspecified vulnerability in Oracle
    Reports Developer.

  - CVE-2007-0286: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2007-0287: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2007-0288: Unspecified vulnerability in Oracle
    Internet Directory.

  - CVE-2007-0289: Multiple unspecified vulnerabilities in
    Oracle Containers for J2EE.

  - CVE-2007-1359: Improper access control in mod_security.

  - CVE-2007-1609: Cross-site scripting vulnerability in
    servlet/Spy in Dynamic Monitoring Services (DMS).

  - CVE-2007-2119: Cross-site scripting vulnerability in the
    Administration Front End for Oracle Enterprise (Ultra)
    Search.

  - CVE-2007-2120: Denial of service in the Oracle
    Discoverer servlet.

  - CVE-2007-2121: Unspecified vulnerability in the COREid
    Access component.

  - CVE-2007-2122: Unspecified vulnerability in the Wireless
    component.

  - CVE-2007-2123: Unspecified vulnerability in the Portal
    component.

  - CVE-2007-2124: Unspecified vulnerability in the Portal
    component.

  - CVE-2007-2130: Unspecified vulnerability in Workflow
    Cartridge.

  - CVE-2007-3553: Cross-site scripting vulnerability in
    Rapid Install Web Server.

  - CVE-2007-3854: Multiple unspecified vulnerabilities in
    the Advanced Queuing component and the Spatial
    component.

  - CVE-2007-3859: Unspecified vulnerability in the Oracle
    Internet Directory component.

  - CVE-2007-3861: Unspecified vulnerability in Oracle
    Jdeveloper.

  - CVE-2007-3862: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2007-3863: Unspecified vulnerability in Oracle
    JDeveloper.

  - CVE-2007-5516: Unspecified vulnerability in the Oracle
    Process Mgmt & Notification component.

  - CVE-2007-5517: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2007-5518: Unspecified vulnerability in HTTP Server.

  - CVE-2007-5519: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2007-5520: Unspecified vulnerability in the Oracle
    Internet Directory component.

  - CVE-2007-5521: Unspecified vulnerability in Oracle
    Containers for J2EE.

  - CVE-2007-5522: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2007-5523: Unspecified vulnerability in the Oracle
    Internet Directory component.

  - CVE-2007-5524: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2007-5525: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2007-5526: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2007-5531: Unspecified vulnerability in Oracle Help
    for Web.

  - CVE-2008-0340: Multiple unspecified vulnerabilities in
    the Advanced Queuing component and Spatial component.

  - CVE-2008-0343: Unspecified vulnerability in the Oracle
    Spatial component.

  - CVE-2008-0344: Unspecified vulnerability in the Oracle
    Spatial component.

  - CVE-2008-0345: Unspecified vulnerability in the Core
    RDBMS component.

  - CVE-2008-0346: Unspecified vulnerability in the Oracle
    Jinitiator component.

  - CVE-2008-0347: Unspecified vulnerability in the Oracle
    Ultra Search component.

  - CVE-2008-0348: Multiple unspecified vulnerabilities in
    the PeopleTools component.

  - CVE-2008-0349: Unspecified vulnerability in the
    PeopleTools component.

  - CVE-2008-1812: Unspecified vulnerability in the Oracle
    Enterprise Manager component.

  - CVE-2008-1814: Unspecified vulnerability in the Oracle
    Secure Enterprise Search or Ultrasearch component.

  - CVE-2008-1823: Unspecified vulnerability in the Oracle
    Jinitiator component.

  - CVE-2008-1824: Unspecified vulnerability in the Oracle
    Dynamic Monitoring Service component.

  - CVE-2008-1825: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-2583: Unspecified vulnerability in the sample
    Discussion Forum Portlet for the Oracle Portal
    component.

  - CVE-2008-2588: Unspecified vulnerability in the Oracle
    JDeveloper component.

  - CVE-2008-2589: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-2593: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-2594: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-2595: Unspecified vulnerability in the Oracle
    Internet Directory component.

  - CVE-2008-2609: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-2612: Unspecified vulnerability in the Hyperion
    BI Plus component.

  - CVE-2008-2614: Unspecified vulnerability in HTTP Server.

  - CVE-2008-2619: Unspecified vulnerability in the Oracle
    Reports Developer component.

  - CVE-2008-2623: Unspecified vulnerability in the Oracle
    JDeveloper component.

  - CVE-2008-3975: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-3977: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-3986: Unspecified vulnerability in the Oracle
    Discoverer Administrator component.

  - CVE-2008-3987: Unspecified vulnerability in the Oracle
    Discoverer Desktop component.

  - CVE-2008-4014: Unspecified vulnerability in the Oracle
    BPEL Process Manager component.

  - CVE-2008-4017: Unspecified vulnerability in the OC4J
    component.

  - CVE-2008-5438: Unspecified vulnerability in the Oracle
    Portal component.

  - CVE-2008-7233: Unspecified vulnerability in the Oracle
    Jinitiator component.

  - CVE-2009-0217: Signature spoofing vulnerability in
    multiple components.

  - CVE-2009-0989: Unspecified vulnerability in the BI
    Publisher component.

  - CVE-2009-0990: Unspecified vulnerability in the BI
    Publisher component.

  - CVE-2009-0994: Unspecified vulnerability in the BI
    Publisher component.

  - CVE-2009-1008: Unspecified vulnerability in the Outside
    In Technology component.

  - CVE-2009-1009: Unspecified vulnerability in the Outside
    In Technology component.

  - CVE-2009-1010: Unspecified vulnerability in the Outside
    In Technology component.

  - CVE-2009-1011: Unspecified vulnerability in the Outside
    In Technology component.

  - CVE-2009-1017: Unspecified vulnerability in the BI
    Publisher component.

  - CVE-2009-1976: Unspecified vulnerability in HTTP Server.

  - CVE-2009-1990: Unspecified vulnerability in the Business
    Intelligence Enterprise Edition component.

  - CVE-2009-1999: Unspecified vulnerability in the Business
    Intelligence Enterprise Edition component.

  - CVE-2009-3407: Unspecified vulnerability in the Portal
    component.

  - CVE-2009-3412: Unspecified vulnerability in the Unzip
    component.

  - CVE-2010-0066: Unspecified vulnerability in the Access
    Manager Identity Server component.

  - CVE-2010-0067: Unspecified vulnerability in the Oracle
    Containers for J2EE component.

  - CVE-2010-0070: Unspecified vulnerability in the Oracle
    Containers for J2EE component.

  - CVE-2011-0789: Unspecified vulnerability in HTTP Server.

  - CVE-2011-0795: Unspecified vulnerability in Single
    Sign-On.

  - CVE-2011-0884: Unspecified vulnerability in the Oracle
    BPEL Process Manager component.

  - CVE-2011-2237: Unspecified vulnerability in the Oracle
    Web Services Manager component.

  - CVE-2011-2314: Unspecified vulnerability in the Oracle
    Containers for J2EE component.

  - CVE-2011-3523: Unspecified vulnerability in the Oracle
    Web Services Manager component.");
  script_set_attribute(attribute:"solution", value:
"Verify that the version of Oracle Application Server installed is not
affected by the listed vulnerabilities and/or filter incoming traffic to this port");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"remote code execution");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploithub_sku", value:"EH-11-053");
  script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"Oracle Secure Backup 10.2.0.2 RCE (Windows)");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(22, 79, 119, 200, 255, 264, 287);
  script_set_attribute(attribute:"vuln_publication_date", value:"2000/03/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/10/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/24");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service2.nasl");
  script_require_keys("Settings/PCI_DSS", "Settings/ParanoidReport");
  script_require_ports("Services/oracle_application_server");

  exit(0);
}

include("global_settings.inc");
include("http.inc");
include("misc_func.inc");

# Only PCI considers this an issue.
if (!get_kb_item("Settings/PCI_DSS")) exit(0, "PCI-DSS compliance checking is not enabled.");

# Make sure this is Oracle.
port = get_kb_item_or_exit("Services/oracle_application_server");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# We're flagging every installation of Oracle Application Server, with
# every vulnerability it has ever had.
security_hole(port);
  • NASL familyDatabases
    NASL idORACLE_RDBMS_CPU_JAN_2007.NASL
    descriptionThe remote Oracle database server is missing the January 2007 Critical Patch Update (CPU) and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Advanced Replication - Advanced Security Option - Change Data Capture - Data Guard - Export - Log Miner - NLS Runtime - Oracle Net Services - Oracle Spatial - Oracle Streams - Oracle Text - Oracle Workflow Cartridge - Recovery Manager - XMLDB
    last seen2020-06-02
    modified2011-11-16
    plugin id56055
    published2011-11-16
    reporterThis script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/56055
    titleOracle Database Multiple Vulnerabilities (January 2007 CPU)
    code
    #
# (C) Tenable Network Security, Inc.
#


include('compat.inc');

if (description)
{
  script_id(56055);
  script_version("1.15");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");

  script_cve_id(
    "CVE-2007-0268",
    "CVE-2007-0269",
    "CVE-2007-0270",
    "CVE-2007-0271",
    "CVE-2007-0272",
    "CVE-2007-0273",
    "CVE-2007-0274",
    "CVE-2007-0275",
    "CVE-2007-0276",
    "CVE-2007-0277",
    "CVE-2007-0278"
  );
  script_bugtraq_id(22083);

  script_name(english:"Oracle Database Multiple Vulnerabilities (January 2007 CPU)");
  script_summary(english:"Checks installed patch info");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by multiple vulnerabilities.");

  script_set_attribute(attribute:"description", value:
"The remote Oracle database server is missing the January 2007
Critical Patch Update (CPU) and therefore is potentially affected by
security issues in the following components :

  - Advanced Queuing

  - Advanced Replication

  - Advanced Security Option

  - Change Data Capture

  - Data Guard

  - Export

  - Log Miner

  - NLS Runtime

  - Oracle Net Services

  - Oracle Spatial

  - Oracle Streams

  - Oracle Text

  - Oracle Workflow Cartridge

  - Recovery Manager

  - XMLDB");

  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11b7e0a4");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the January 2007 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"exploithub_sku", value:"EH-11-860");
  script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
  script_cwe_id(79, 119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/01/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2007/01/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/11/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"agent", value:"all");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include("oracle_rdbms_cpu_func.inc");

################################################################################
# JAN2007
patches = make_nested_array();

# RDBMS 10.1.0.4
patches["10.1.0.4"]["db"]["nix"] = make_array("patch_level", "10.1.0.4.8", "CPU", "5689894");
patches["10.1.0.4"]["db"]["win32"] = make_array("patch_level", "10.1.0.4.16", "CPU", "5695771");
# RDBMS 10.1.0.5
patches["10.1.0.5"]["db"]["nix"] = make_array("patch_level", "10.1.0.5.5", "CPU", "5689908");
patches["10.1.0.5"]["db"]["win32"] = make_array("patch_level", "10.1.0.5.11", "CPU", "5716295");
# RDBMS 10.2.0.3
patches["10.2.0.3"]["db"]["nix"] = make_array("patch_level", "10.2.0.3.1", "CPU", "5881721");
patches["10.2.0.3"]["db"]["win32"] = make_array("patch_level", "10.2.0.3.2", "CPU", "5846376");
patches["10.2.0.3"]["db"]["win64"] = make_array("patch_level", "10.2.0.3.2", "CPU", "5846378");
# RDBMS 10.2.0.2
patches["10.2.0.2"]["db"]["nix"] = make_array("patch_level", "10.2.0.2.4", "CPU", "5689957");
patches["10.2.0.2"]["db"]["win32"] = make_array("patch_level", "10.2.0.2.6", "CPU", "5716143");
patches["10.2.0.2"]["db"]["win64"] = make_array("patch_level", "10.2.0.2.6", "CPU", "5699839");
# RDBMS 10.2.0.1
patches["10.2.0.1"]["db"]["nix"] = make_array("patch_level", "10.2.0.1.5", "CPU", "5689937");
patches["10.2.0.1"]["db"]["win32"] = make_array("patch_level", "10.2.0.1.9", "CPU", "5695784");
patches["10.2.0.1"]["db"]["win64"] = make_array("patch_level", "10.2.0.1.9", "CPU", "5695786");
# RDBMS 10.1.0.3
patches["10.1.0.3"]["db"]["nix"] = make_array("patch_level", "10.1.0.3.9", "CPU", "5923277");

check_oracle_database(patches:patches, high_risk:TRUE);

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/102234/oraclehttp-xss.txt
idPACKETSTORM:102234
last seen2016-12-05
published2011-06-14
reporterYasser ABOUKIR
sourcehttps://packetstormsecurity.com/files/102234/Oracle-HTTP-Server-Header-Cross-Site-Scripting.html
titleOracle HTTP Server Header Cross Site Scripting

Seebug

bulletinFamilyexploit
descriptionNo description provided by source.
idSSV:71772
last seen2017-11-19
modified2014-07-01
published2014-07-01
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-71772
titleOracle HTTP Server - XSS Header Injection

References