testing for 'Dangling Cursor'

Question

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.

I was wondering if there are any tools, similar to a Sql Injection fuzzer, that I could use to test my server for possible exploits. I am running Windows Server 08 with Oracle 10g on IIS 7. FOSS would be great, but I would pay some for a solid testing suite that can check for this exploit.

Answer 1

I'm not aware of any publicly available toolsets for this at the moment, but there's been a couple of interesting white-papers and postings recently on the general security dangers of cursors

Two from David Litchfield here and here

and an interesting blog posting from Pete Finnigan here