Secunia Security Advisory - Some vulnerabilities have been reported in Oracle E-Business Suite, which can be exploited by malicious users to conduct SQL injection attacks or disclose potentially sensitive information, and by malicious people to bypass certain security restrictions.
de25b55dafc45f138bddefc3111693164ce0f73cef489b478dc101edbd92a9a3
TITLE:
Oracle E-Business Suite Diagnostics Pack Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA19076
VERIFY ADVISORY:
http://secunia.com/advisories/19076/
CRITICAL:
Less critical
IMPACT:
Security Bypass, Manipulation of data, Exposure of sensitive
information
WHERE:
>From local network
SOFTWARE:
Oracle E-Business Suite 11i
http://secunia.com/product/442/
DESCRIPTION:
Some vulnerabilities have been reported in Oracle E-Business Suite,
which can be exploited by malicious users to conduct SQL injection
attacks or disclose potentially sensitive information, and by
malicious people to bypass certain security restrictions.
1) Missing access control restrictions in the Oracle Diagnostics web
pages can be exploited to execute certain diagnostics tests without
requiring any prior authentication, and by malicious users to
retrieve diagnostic test logfiles belonging to other users.
2) Some unspecified SQL injection vulnerabilities have also been
reported.
The vulnerabilities have been reported in Oracle E-Business Suite
with Diagnostics Support Pack installed.
SOLUTION:
The vulnerabilities have reportedly been fixed in Diagnostics Support
Pack February 2006 with Oracle Diagnostics 2.3 RUP A, which will be
included with the 2006-04 quarterly update.
PROVIDED AND/OR DISCOVERED BY:
Integrigy
ORIGINAL ADVISORY:
http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------