{"vuid":"VU#826463","idnumber":"826463","name":"Oracle E-Business Suite password disclosure vulnerability","keywords":["oracle","ebusiness","password","disclosure","cwe-200"],"overview":"Oracle E-Business Suite 12.0-12.1, when used with the native login pages or single sign-on (SSO) / Oracle Access Management (OAM) with the native login pages, contains a credential exposure vulnerability.","clean_desc":"Oracle E-Business Suite administrators who have applied CPU patches for July 2012, October 2012, January 2013, or April 2013 and use the native login pages are affected by a credential exposure vulnerability (CWE-200). Credentials are exposed to the FND_LOG_MESSAGES database table or a log file. The credentials in the logs will be viewable by an attacker wilth privileged database or privileged operating system access.","impact":"An authenticated attacker with privileged access may be able to read Oracle E-Business Suite credentials from the database logs.","resolution":"Apply an Update Oracle E-Business Suite administrators are advised to apply Oracle CPU July 2013 to address this vulnerability. Please see My Oracle Support (MOS) Note 1579709.1 for additional details and mitigation steps.","workarounds":"Purge credentials from the database logs Oracle E-Business Suite administrators that are affected by this vulnerability should purge the database logs of any credentials that were exposed. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps: MITIGATION STEP Prevent Logging of Passwords\nFor customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES. In SQL*Plus, login as APPS, and do the following: CREATE OR REPLACE TRIGGER\nFND_LOG_MESSAGES_BI\nBEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES\nREFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW\nWHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')\nBEGIN\n:NEW.message_text := 'Ignored'; END; Once the JUL 2013 CPU has been applied, the trigger is no longer required and should be dropped for performance reasons. In SQL*Plus, login as APPS, and do the following: DROP TRIGGER\nFND_LOG_MESSAGES_BI; MITIGATION STEP Cleanup Old Log Entries\nCustomers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013 will have log entries that need to be purged. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows. Customers that have applied one of the patches with the vulnerability listed above will likely have log entries that need to be purged. By default, E-Business Suite logs to FND_LOG_MESSAGES. Customers can optionally configure the system to log to a file on the applications tier by setting the AFLOG_FILENAME profile (this parameter can also be set as a java system property or environment variable). See Oracle E-Business Suite System Administrator's Guide - Configuration: Logging for more information on logging configuration. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows. In SQL*Plus, login as APPS, and do one of the following: TRUNCATE TABLE FND_LOG_MESSAGES; or DELETE FND_LOG_MESSAGES\n  where MODULE  like 'fnd.sso.SecureHttpRequest%.secureParse'; COMMIT; For log files in the file system purge the log files, or you can run the following commands to remove the specific problematic entries: For a single file sed -i  -e '/fnd.sso.SecureHttpRequest/d' file_name or for multiple files find /some/dir  -name '*.log' -exec  \\\nsed -i -e '/fnd.sso.SecureHttpRequest/d' {} \\; Change passwords for affected accounts Oracle E-Business Suite administrators that feel this exposure may have compromised the credentials should force the passwords to be changed for the affected accounts. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps: MITIGATION STEP Force a password change for all E-Business Suite accounts (optional)\nIf you suspect that logs with passwords have been compromised via the production instance, cloned database copies, or database backups, you should force a password change for all E-Business Suite accounts. For passwords that are managed through OID, passwords should be expired via OID. For passwords managed by E-Business Suite you can force a password change by performing the following steps: 1. Login to database as the APPS user, and run the following SQL: UPDATE FND_USER set PASSWORD_DATE = NULL\n  where nvl(END_DATE, sysdate+1) > sysdate\n    and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',\n        'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',\n        'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',\n        'ORACLE12.8.0','ORACLE12.9.0'); COMMIT; 2. Login to E-Business Suite as the SYSADMIN user. You will be prompted to change the SYSADMIN password. Change the SYSADMIN password. 3. To change the GUEST password, follow MOS note:  443353.1 - How To Successfully Change The Guest Password In E-Business Suite 11.5.10 and R12\n4. To change the ASASMIN password, follow MOS note:  556540.1 - Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12  -  Section: 3.3, Steps: (8 - 11) For any additional clarification please contact Oracle Support.","sysaffected":"","thanks":"Thanks to Jeff Kayser of Jibe Consulting, Inc. for reporting this vulnerability.","author":"This document was written by Jared Allar.","public":["http://www.oracle.com/us/products/applications/ebusiness/overview/index.html","http://cwe.mitre.org/data/definitions/200.html","http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html","https://support.oracle.com/"],"cveids":["CVE-2013-3749"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2013-08-30T11:58:54Z","publicdate":"2013-10-14T00:00:00Z","datefirstpublished":"2013-09-04T17:16:17Z","dateupdated":"2013-09-04T17:16:20Z","revision":26,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"L","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"N","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"4.6","cvss_basevector":"AV:L/AC:L/Au:S/C:C/I:N/A:N","cvss_temporalscore":"4","cvss_environmentalscore":"3","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}