TITLE:
Oracle E-Business Suite Diagnostics Pack Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA19076

VERIFY ADVISORY:
http://secunia.com/advisories/19076/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Manipulation of data, Exposure of sensitive
information

WHERE:
>From local network

SOFTWARE:
Oracle E-Business Suite 11i
http://secunia.com/product/442/

DESCRIPTION:
Some vulnerabilities have been reported in Oracle E-Business Suite,
which can be exploited by malicious users to conduct SQL injection
attacks or disclose potentially sensitive information, and by
malicious people to bypass certain security restrictions.

1) Missing access control restrictions in the Oracle Diagnostics web
pages can be exploited to execute certain diagnostics tests without
requiring any prior authentication, and by malicious users to
retrieve diagnostic test logfiles belonging to other users.

2) Some unspecified SQL injection vulnerabilities have also been
reported.

The vulnerabilities have been reported in Oracle E-Business Suite
with Diagnostics Support Pack installed.

SOLUTION:
The vulnerabilities have reportedly been fixed in Diagnostics Support
Pack February 2006 with Oracle Diagnostics 2.3 RUP A, which will be
included with the 2006-04 quarterly update.

PROVIDED AND/OR DISCOVERED BY:
Integrigy

ORIGINAL ADVISORY:
http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------