Description
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
References
- 1014527 vdb-entry
- oracle-january2006-update(24321) vdb-entry
- 20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days) mailing-list
- 1014525 vdb-entry
- 20050719 Oracle Security Advisory: Read parts of any XML-file via customize parameter in Oracle Reports mailing-list
- http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html
- 18493 third-party-advisory
- ADV-2006-0323 vdb-entry
- 20050719 Oracle Security Advisory: Read parts of any file via desformat in Oracle Reports mailing-list
- 18608 third-party-advisory
- http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html