Pentest 
Limited

Vulnerability in Oracle XDB Server

Pentest Limited Security Advisory

Advisory Details

Title: Vulnerability in Oracle XDB Server
Announcement date: 23rd September 2004
Advisory Reference: ptl-2004-04
Products: Oracle XML Database Server
Vulnerability Type: Denial Of Service
Vendor-URL: http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
Vendor-Status: Patch Available
Remotely Exploitable: Yes
Locally Exploitable: Yes
Advisory URL: http://www.pentest.co.uk

Vulnerability Description

An HTTP request to the Oracle XDB Server on port 8080 that contains a malformed HTTP header can cause a denial of service condition. This allows an unauthenticated remote user to crash the Oracle database instance.

Fix / Workarounds

Apply patch #68 available from Oracle Metalink.

Credit

This vulnerability was discovered by Pentest Limited


back to alerts