Oracle E-Business Suite password disclosure vulnerability

Overview

Oracle E-Business Suite 12.0-12.1, when used with the native login pages or single sign-on (SSO) / Oracle Access Management (OAM) with the native login pages, contains a credential exposure vulnerability.

Description

Oracle E-Business Suite administrators who have applied CPU patches for July 2012, October 2012, January 2013, or April 2013 and use the native login pages are affected by a credential exposure vulnerability (CWE-200). Credentials are exposed to the FND_LOG_MESSAGES database table or a log file. The credentials in the logs will be viewable by an attacker wilth privileged database or privileged operating system access.

---

Impact

An authenticated attacker with privileged access may be able to read Oracle E-Business Suite credentials from the database logs.

---

Solution

Apply an Update

Oracle E-Business Suite administrators are advised to apply Oracle CPU July 2013 to address this vulnerability. Please see My Oracle Support (MOS) Note 1579709.1 for additional details and mitigation steps.

---

Purge credentials from the database logs

Oracle E-Business Suite administrators that are affected by this vulnerability should purge the database logs of any credentials that were exposed. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:

MITIGATION STEP Prevent Logging of Passwords
For customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES.
_ _
In SQL*Plus, login as APPS, and do the following:

_ _
_CREATE OR REPLACE TRIGGER_
_FND_LOG_MESSAGES_BI_
_BEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES_
_REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW_
_WHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')_
_BEGIN_
_:NEW.message_text := 'Ignored';_
_END;_
_/__ _
Once the JUL 2013 CPU has been applied, the trigger is no longer required and should be dropped for performance reasons.
_ _
In SQL*Plus, login as APPS, and do the following:

_ _
_DROP TRIGGER_
_FND_LOG_MESSAGES_BI;_
MITIGATION STEP Cleanup Old Log Entries
Customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013 will have log entries that need to be purged. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.
_ _
_Customers that have applied one of the patches with the vulnerability listed above will likely have log entries that need to be purged. By default, E-Business Suite logs to FND_LOG_MESSAGES. Customers can optionally configure the system to log to a file on the applications tier by setting the AFLOG_FILENAME profile (this parameter can also be set as a java system property or environment variable). See __Oracle E-Business Suite System Administrator’s Guide - Configuration: Logging __for more information on logging configuration. _
_ _
For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.
_ _
In SQL*Plus, login as APPS, and do one of the following:

_ _
_TRUNCATE TABLE FND_LOG_MESSAGES;_
_ _
_or_
_ _
_DELETE FND_LOG_MESSAGES_
_ where MODULE like 'fnd.sso.SecureHttpRequest%.secureParse';_
_COMMIT;_``_ _
_ _
For log files in the file system purge the log files, or you can run the following commands to remove the specific problematic entries:
_ _
For a single file
_ _

_sed -i -e '/fnd.sso.SecureHttpRequest/d' file_name_``_ _
or for multiple files
_ _

_find /some/dir -name '*.log' -exec \_
_sed -i -e '/fnd.sso.SecureHttpRequest/d' {} \;_
Change passwords for affected accounts

Oracle E-Business Suite administrators that feel this exposure may have compromised the credentials should force the passwords to be changed for the affected accounts. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:

MITIGATION STEP Force a password change for all E-Business Suite accounts (optional)
If you suspect that logs with passwords have been compromised via the production instance, cloned database copies, or database backups, you should force a password change for all E-Business Suite accounts. For passwords that are managed through OID, passwords should be expired via OID. For passwords managed by E-Business Suite you can force a password change by performing the following steps:
_ _
1. Login to database as the APPS user, and run the following SQL:
_ _

_UPDATE FND_USER set PASSWORD_DATE = NULL_
_ where nvl(END_DATE, sysdate+1) > sysdate_
_ and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',_
_ 'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',_
_ 'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',_
_ 'ORACLE12.8.0','ORACLE12.9.0');_
_COMMIT;__ _
2. Login to E-Business Suite as the SYSADMIN user. You will be prompted to change the SYSADMIN password. Change the SYSADMIN password.
_3. To change the GUEST password, follow MOS note: _443353.1 - How To Successfully Change The Guest Password In E-Business Suite 11.5.10 and R12
_4. To change the ASASMIN password, follow MOS note: _556540.1 - Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12 - Section: 3.3, Steps: (8 - 11)
_ _
For any additional clarification please contact Oracle Support.

Vendor Information

826463

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Oracle Corporation Affected

Notified: August 30, 2013 Updated: September 04, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	4.6	AV:L/AC:L/Au:S/C:C/I:N/A:N
Temporal	4	E:H/RL:OF/RC:C
Environmental	3	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://www.oracle.com/us/products/applications/ebusiness/overview/index.html&gt;
• <http://cwe.mitre.org/data/definitions/200.html&gt;
• <http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html&gt;
• <https://support.oracle.com/&gt;

Acknowledgements

Thanks to Jeff Kayser of Jibe Consulting, Inc. for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2013-3749
Date Public:	2013-10-14 Date First Published: