Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.

I was wondering if there are any tools, similar to a Sql Injection fuzzer, that I could use to test my server for possible exploits. I am running Windows Server 08 with Oracle 10g on IIS 7. FOSS would be great, but I would pay some for a solid testing suite that can check for this exploit.

share|improve this question
why the down votes? – Justin C Jul 8 '11 at 16:45
up vote 3 down vote accepted

I'm not aware of any publicly available toolsets for this at the moment, but there's been a couple of interesting white-papers and postings recently on the general security dangers of cursors

Two from David Litchfield here and here

and an interesting blog posting from Pete Finnigan here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.