Oracle Database Server and Oracle Enterprise Manager Grid Control contain a flaw that allows HTTP response splitting. This flaw exists because the application does not validate the 'pageName' parameter upon submission to the /em/console/database/schema/grantObjPrivs script. This could allow a context-dependent attacker to insert arbitrary HTTP headers, which are included in a response sent to the user.

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• Security Tracker: 1026929
• CVE ID: 2012-0527 (see also: NVD)
• Secunia Advisory ID: 48855 48870 50404
• Generic Informational URL: http://en.wikipedia.org/wiki/HTTP_response_splitting
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00018.html
• Packet Storm: http://packetstormsecurity.org/files/112013/Oracle-Enterprise-Manager-pageName-HTTP-Response-Splitting.html
• Mail List Post: http://seclists.org/bugtraq/2012/Apr/154
• Vendor Specific Advisory URL: http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
• Other Advisory URL: https://www.teamshatter.com/?p=3453

• Esteban Martínez Fayó - Application Security Inc.