Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs SecuriTeam™ in Your Inbox   E-mail this CVE-2009-1967 to a friend New vulnerability? New tool? Tell us	CVE-2009-1967 Oracle Enterprise Manager SQL Injection Vulnerability     Credit: The information has been provided by Esteban Mart nez Fay . The original article can be found at: http://www.appsecinc.com/resources/alerts/oracle/2009-04.shtml Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    CVE-2009-1967 Details Check for CVE-2009-1967 Vulnerability Assessment and Management. Automated Pen Testing for 50 to 50,000 nodes beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * Oracle Enterprise Manager Database Control versions 11.1.0.6 and 11.1.0.7  * Oracle Enterprise Manager 10g Grid Control version 10.2.0.4 and prior SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. The 'Type', 'snapshot' and 'table' parameters used in web page /em/console/ecm/history/configHistory and 'fConfigGuid' parameter used in /em/console/ecm/config/compare/compareWizSecondConfig are vulnerable to SQL Injection attacks. These web pages are part of Oracle Enterprise Manager web application. It may be possible for a malicious user to execute a function with the elevated privileges of the SYSMAN database user in the repository database. This user has the DBA role granted. Patch Availability: Apply Oracle Critical Patch Update July 2009 http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2009.html CVE Information: CVE-2009-1966 CVE-2009-1967 Disclosure Timeline: 7/11/2008 Vendor Notification 7/14/2008 Vendor Response 7/14/2009 Fix 7/22/2009 Public Disclosure  Comments on CVE-2009-1967:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Copyright © 1998-2010 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®