In-Depth Research, Timely Responsible Notifications
The nature of the IT security business requires us to remain one step ahead of malicious users. Our continual vigilance and timely dissemination of security information mitigates the damage from database and application threats and vulnerabilities. We at the Imperva Application Defense Center are intent on building the most advanced application and database security knowledge base in the world by discovering database vulnerabilities before they're exploited.
In order to bring you these published Security Advisories, we conduct in-depth research in our labs, utilize real-world experience, and leverage publicly available information. Each day, we strive to uncover new security attack and defense techniques and application, platform, and database vulnerabilities. When we find a database or application security issue, we work within industry guidelines and responsible ethics to notify the vendor and publish the Advisory. Our ultimate goal is to provide you with accurate, timely information so that you know the steps you need to take to secure your applications, databases, and protect confidential data.
Benefit to SecureSphere Customers
Imperva customers benefit from our research with updates to SecureSphere through automated ADC Security Updates as well as ADC Insights. With Imperva, you are protected against the latest security threats, often well ahead of patches released from application and database security vendors.
Boy in the Browser (BitB) – February 2011
ADC Security Advisories
The following are currently published ADC Security Advisories. Periodically check this page to locate newly published Advisories.
Imperva’s lab, the Application Defense Center (ADC), has recently uncovered a rush of proxy Trojans with a common underlying technique. This technique, dubbed the "Boy in the Browser" (BitB), evolved from traditional key loggers and browser session records. DDOS Advisory – May 2010
Imperva's lab, the Application Defense Center (ADC), has uncovered a new generation of DDoS attack that appears to be more powerful, more efficient and less detectable than traditional methods. DB2 UDB - FDOCA Manipulation DoS Attack
This security advisory discusses an FD:OCA data object structure vulnerability that allows an attacker to terminate the DB2 UDB's service, effectively denying service from all database users.Oracle SYS.DBMS_AQADM – Privilege Elevation Vulnerability - EVENT
An attacker can abuse the dbms_adadm.set_session_event procedure to set the value for session attributes that would otherwise require high privileges such as “sql_trace”.
Oracle SYS.DBMS_AQADM_SYS – Privilege Elevation Vulnerability - STMT
An attacker can execute arbitrary SQL queries using the DBMS_AQADM_SYS.EXECTUE_STMT procedure.
Oracle SYS.DBMS_IJOB – Job manipulation vulnerability - OTHER (CVE-2010-2411)
An attacker can effectively terminate the execution of jobs scheduled by other users without proper authorization, thus impacting the overall integrity of the information.
Oracle SYS.DBMS_IJOB – Privilege Elevation Vulnerability - SUBMIT (CVE-2010-2411)
An attacker can execute arbitrary PL/SQL code by submitting jobs to run under the security context of privileged users such as SYSTEM. This vulnerability impacts all aspects of the information (confidentiality, integrity and availability).
Oracle SYS.DBMS_IJOB – Privilege Elevation Vulnerability - WHAT (CVE-2010-2411)
An attacker can execute arbitrary PL/SQL code by tampering with jobs already submitted by privileged users such as SYSTEM. This vulnerability impacts all aspects of the information (confidentiality, integrity and availability).
Oracle Data Mining – Buffer Overflow Vulnerability (CVE-2009-1007)
A buffer overflow vulnerability in the Oracle Data Mining low level routines allows an attacker to execute arbitrary code in the context of the database server.
ORACLE RDMBS - Unauthenticated Session Exhaustion, Denial of Service Attack
An unauthenticated attacker can quickly exhaust all available session resources, denying further access to the database by legtimiate users.
Oracle EBS - Unauthenticated Unchecked Redirect Vulnerability (CVE-2009-0995)
An unchecked redirect vulnerability was discovered. This vulnerability can be exploited for stealing sensitive data and executing Phishing attacks.
Oracle EBS - SQL Injection vulnerability
This security advisory discusses a SQL Injection vulnerability in an unauthenticated part of the application.Oracle EBS - XSS and Unchecked Redirection vulnerabilities
This security advisory discusses vulnerabilities can be exploited for stealing sensitive data and executing Phishing attacks.Oracle PeopleTools – Authentication Weakness
This security advisory discusses a vulnerability, affecting PeopleSoft applications, enabling unrestricted brute force login attacks that was discovered by Imperva.Oracle DBMS – Proxy Authentication Vulnerability
This security advisory discusses a vulnerability, discovered by Imperva, that allows an attacker to establish a database session without supplying a password when connecting through Oracle's proxy authentication mode.Oracle DBMS – Access Control Bypass with Direct Path Export
This security advisory discusses an access control bypass vulnerability that was discovered by Imperva. Informix DBMS - SQ_ONASSIST Denial of Service Attack
This advisory describes a Denial of Service Attack to Informix Dynamic Server. This vulnerability was discovered by Imperva and fixed in the IBM IDS 11.10.*C2 release in October 2007.Oracle EBS – XSS Vulnerability
This security advisory discusses a cross-site scripting vulnerability in Oracle E-Business Suite that was discovered by Imperva and is addressed in Oracle's July 2007 Critical Patch Update.Web 2.0, AJAX and Client Security Logic
Illustrates the need for the validation of database communication protocols in database security products.DB2 DBMS - Critical Buffer Overrun Vulnerability
An illustration of the risk of depending on database vendor patches for database security.Oracle DBMS - Critical Patch Update 04/18/06
This security advisory discusses the database vulnerabilities in Oracle's April 2006 CPU and offers some available workarounds.Oracle DBMS - Critical Access Control Bypass in Login Bug
An illustration of the risk of depending on database vendor patches for database security.Microsoft SQL Server Audit Bug
An illustration of the problems created when relying on a database server to audit itself. Arbitrary File Access and Denial of Service Vulnerabilities in Business Objects' Crystal Report Web Delivery Modules
Crystal Reports modules which deliver image files through the web are vulnerable in a way that can be exploited for arbitrary file access and denial of service.Incorrect Handling of Cross Site Scripting Protection in ASP.Net
The ASP.Net request validation feature has an implementation flaw which allows an attacker to easily bypass the content restrictions, possibly exposing the application to cross site scripting and script injection attacks.
ADC Security Responses
If Imperva SecureSphere is listed on a vulnerability alert, such as from CERT, the ADC publishes Security Responses to those alerts. Check this page to locate newly published Responses.Imperva Security Response for CVE-2014-0160 – aka "Heartbleed"
OpenSSL 1.0.1 before 1.0.1g does not properly handle Heartbeat Extension packetsImperva Security Response for CVE-2011-4887
Under some configurations an attacker can invoke a XSS attack against the SecureSphere WAF management GUI by sending a request containing a maliciously crafted XSS vector to a web server protected by SecureSphere. Imperva Security Response for CVE-2011-0767
Under some configurations an attacker can invoke a XSS attack against the SecureSphere management GUI by sending a request containing a maliciously crafted XSS vector to a web server protected by SecureSphere.Imperva Security Response for CVE-2010-1329
It is possible to evade some of the detection mechanisms of the SecureSphere Web Application Firewall and Database Firewall by sending a specially crafted, extremely large request.Imperva Security Response for VU#739224
The U.S. Computer Emergency Response Team (US-CERT) has reported a Web attack evasion technique using full-width and half-width Unicode characters intended to evade inspection by IDS/IPS/WAF security products.
Upcoming Security Alerts
Back to Top
|Report Date||Vendor Code||Versions Affected||Severity|
|02-Aug-2007||Informix IDS 10TC3||High|
|25-Feb-2007||Informix IDS 11 and earlier||Critical|
|25-Feb-2007||Informix IDS 10 TC5||Low|
|17-Jan-2007||Informix IDS 10UC6 and earlier||High|
|22-Apr-2009||14435443||Oracle 10.2 and later||Low|
|19-Apr-2009||14428169||Oracle 10.2 and later||Low|
|20-Jan-2009||13761009||Oracle 10.2 and later||Low|
|20-Jan-2009||13767417||Oracle 10.2 and later||Low|
|20-Jan-2009||13795651||Oracle 10.2 and later||Low|
|31-May-2007||9909517||Oracle EBS all versions||Medium|
|31-May-2007||9909589||Oracle EBS all versions||Low|
|20-Dec-2005||6808279||Oracle 10.2 and earlier||High|
|07-Nov-2007||DWR 2.0.1 and earlier||High|