e-Knights Technologies Solutions Pvt. Ltd.: SQL Injection

Showing posts with label SQL Injection. Show all posts

Saturday, February 23, 2013

SQL Injection in Oracle EM (Resource Manager) (CVE-2013-0358)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Enterprise Manager (Resource Manager)

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5,
11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martinez Fayo of
Application Security Inc.

Details:
SQL Injection works by attempting to modify the parameters passed to an
application to change the SQL statements that are passed to a database. SQL
injection can be used to insert additional SQL statements to be executed.
Some parameters of /em/console/database/instance/rsrcpln are vulnerable to SQL
Injection attacks. This web page is part of Oracle Enterprise Manager web
application. This vulnerability allows to execute SQL statements in the
backend database making a web request as an authenticated user. The
vulnerability can be exploited, by means of cross-site request forgery
attacks, when an Administrator with an open OEM session visits a malicious web
site.

Impact:
An attacker hosting a malicious web site can execute SQL statements in the
backend database when an administrator with an open session in Oracle
Enterprise Manager web application visits the malicious web site.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this vulnerability.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2013-0358

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

https://www.teamshatter.com/?p=4149

Timeline:
Vendor Notification - 8/22/2012
Vendor Response - 8/28/2012
Fix - 1/15/2013
Public Disclosure - 2/20/2013- --
_____________________________________________
Copyright (c) 2013 Application Security, Inc.
http://www.appsecinc.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmdCYACgkQRx91imnNIgExpACfTypwOkrsaIsXlStKyF6p/Jrn
5g8AoMuWwLaNQyTKeD8gbNPcKk/BnEjB
=1/1M
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com

SQL Injection in Oracle EM (streams queue) (CVE-2013-0373)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Enterprise Manager (streams queue)

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5,
11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martinez Fayo of
Application Security Inc.

Details:
SQL Injection works by attempting to modify the parameters passed to an
application to change the SQL statements that are passed to a database. SQL
injection can be used to insert additional SQL statements to be executed.
Some parameters of /em/console/database/dist/streams/queue are vulnerable to
SQL Injection attacks. This web page is part of Oracle Enterprise Manager web
application. This vulnerability allows to execute SQL statements in the
backend database making a web request as an authenticated user. The
vulnerability can be exploited, by means of cross-site request forgery
attacks, when an Administrator with an open OEM session visits a malicious web
site.

Impact:
An attacker hosting a malicious web site can execute SQL statements in the
backend database when an administrator with an open session in Oracle
Enterprise Manager web application visits the malicious web site.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this vulnerability.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2013-0373

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

https://www.teamshatter.com/?p=4156

Timeline:
Vendor Notification - 8/22/2012
Vendor Response - 8/28/2012
Fix - 1/15/2013
Public Disclosure - 2/20/2013
- --
_____________________________________________
Copyright (c) 2013 Application Security, Inc.
http://www.appsecinc.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmcDwACgkQRx91imnNIgFGRwCeJbqzhJQUVTvtjqDrprL+Zt9K
yu4An2Q0aqEe5+bdvyLjvWgoYlJbAVNb
=dUgv
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com

SQL Injection in Oracle EM (SCPLBL_COLLECTED parameters) (CVE-2013-0353)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Enterprise Manager (SCPLBL_COLLECTED parameters)

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martinez Fayo of
Application Security Inc.

Details:
SQL Injection works by attempting to modify the parameters passed to an
application to change the SQL statements that are passed to a database. SQL
injection can be used to insert additional SQL statements to be executed.
Some parameters of /em/console/ecm/config/savedConfig are vulnerable to SQL
Injection attacks. This web page is part of Oracle Enterprise Manager web
application. It may be possible for a malicious user to execute a function
with the elevated privileges of the SYSMAN database user in the repository
database. This user has the DBA role granted. This vulnerability can also be
exploited, by means of cross-site request forgery attacks, when an
Administrator with an open OEM session visits a malicious web site.

Impact:
This vulnerability allow a Oracle Enterprise Manager user with VIEW (or more)
privileges to execute a function call with the elevated privileges of the
SYSMAN database user.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this vulnerability.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2013-0353

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

https://www.teamshatter.com/?p=4152

Timeline:
Vendor Notification - 6/25/2012
Vendor Response - 6/29/2012
Fix - 1/15/2013
Public Disclosure - 2/20/2013- --
_____________________________________________
Copyright (c) 2013 Application Security, Inc.
http://www.appsecinc.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmbNsACgkQRx91imnNIgFEeQCfYDk846kd3FWKZJhddwvxxkdn
gwoAoNN3xyIA07cAAlkXbywWnVZI8icC
=6QMP
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com

SQL Injection in Oracle EM (dBClone) (CVE-2013-0374)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Enterprise Manager (dBClone)

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5,
11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martinez Fayo of
Application Security Inc.

Details:
SQL Injection works by attempting to modify the parameters passed to an
application to change the SQL statements that are passed to a database. SQL
injection can be used to insert additional SQL statements to be executed.
Some parameters of /em/console/database/dbclone/dBClone are vulnerable to SQL
Injection attacks. This web page is part of Oracle Enterprise Manager web
application. It may be possible for a malicious user to execute a function
with the elevated privileges of the SYSMAN database user in the repository
database. This user has the DBA role granted. This vulnerability can also be
exploited, by means of cross-site request forgery attacks, when an
Administrator with an open OEM session visits a malicious web site.

Impact:
This vulnerability allow a Oracle Enterprise Manager user with VIEW (or more)
privileges to execute a function call with the elevated privileges of the
SYSMAN database user.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this vulnerability.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2013-0374

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

https://www.teamshatter.com/?p=4145

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmbNsACgkQRx91imnNIgHo7QCfSJQzpaRGl//95FKIt5zSMtCF
8pYAoI4zumPicyj1j4m5ru3kXahkwHzd
=uU10
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com

SQL Injection in Oracle EM (advReplicationAdmin) (CVE-2013-0372)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Enterprise Manager (advReplicationAdmin)

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Esteban Martinez Fayo of
Application Security Inc.

Details:
SQL Injection works by attempting to modify the parameters passed to an
application to change the SQL statements that are passed to a database. SQL
injection can be used to insert additional SQL statements to be executed. Some
parameters of /em/console/database/dist/advRepl/advReplicationAdmin are
vulnerable to SQL Injection attacks. This web page is part of Oracle
Enterprise Manager web application. This vulnerability allows to execute SQL
statements in the backend database making a web request as an authenticated
user. The vulnerability can be exploited, by means of cross-site request
forgery attacks, when an Administrator with an open OEM session visits a
malicious web site.

Impact:
An attacker hosting a malicious web site can execute SQL statements in the
backend database when an administrator with an open session in Oracle
Enterprise Manager web application visits the malicious web site.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
There is no workaround for this vulnerability.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2013-0372

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

https://www.teamshatter.com/?p=4142

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmbmUACgkQRx91imnNIgGmpQCgr8Wzc9CkJVzkVTxXx9ro8U1h
aFkAoLLabATVXrBOLKKz9/yE9z49pB+P
=WaN+
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com

Friday, February 22, 2013

SQL Injection in Oracle Alter FBA Table (CVE-2012-1751)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TeamSHATTER Security Advisory

SQL Injection in Oracle Alter FBA Table

February 20, 2013

Risk Level:
High

Affected versions:
Oracle Database Enterprise Edition 11.1, 11.2

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Martin Rakhmanov of
Application Security Inc.

Details:
Renaming a table having flashback archive using specially crafted table name
triggers internal SQL injection. This allows users to execute code with
elevated privileges.

Impact:
An attacker having control over a flashback-enabled table can get SYSDBA
privileges.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
Do not grant flashback archive privilege to untrusted users. Limit access to
flashback-enabled tables to trusted users only.

Fix:
Apply Oracle Critical Patch Update October 2012 available at Oracle Support.

CVE:
CVE-2012-1751

Links:
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html

https://www.teamshatter.com/?p=4115

Timeline:
Vendor Notification - 1/23/2012
Vendor Response - 1/26/2012
Fix - 16/10/2012
Public Disclosure - 2/20/2013

- --
_____________________________________________
Copyright (c) 2013 Application Security, Inc.
http://www.appsecinc.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iEYEARECAAYFAlEmJi0ACgkQRx91imnNIgGSSgCeNs5tl388LdVtPjT1DYu8NcNr
j+YAniPtv6/eaFORuczvrLuIphivSTRL
=MSFT
-----END PGP SIGNATURE-----

Courtesy: securityfocus.com