Vulnerability Note VU#826463

Oracle E-Business Suite password disclosure vulnerability

Original Release date: 04 Sep 2013 | Last revised: 04 Sep 2013

Overview

Oracle E-Business Suite 12.0-12.1, when used with the native login pages or single sign-on (SSO) / Oracle Access Management (OAM) with the native login pages, contains a credential exposure vulnerability.

Description

Oracle E-Business Suite administrators who have applied CPU patches for July 2012, October 2012, January 2013, or April 2013 and use the native login pages are affected by a credential exposure vulnerability (CWE-200). Credentials are exposed to the FND_LOG_MESSAGES database table or a log file. The credentials in the logs will be viewable by an attacker wilth privileged database or privileged operating system access.

Impact

An authenticated attacker with privileged access may be able to read Oracle E-Business Suite credentials from the database logs.

Solution

Apply an Update

Oracle E-Business Suite administrators are advised to apply Oracle CPU July 2013 to address this vulnerability. Please see My Oracle Support (MOS) Note 1579709.1 for additional details and mitigation steps.

Purge credentials from the database logs

Oracle E-Business Suite administrators that are affected by this vulnerability should purge the database logs of any credentials that were exposed. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:

    MITIGATION STEP Prevent Logging of Passwords
    For customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013, and have not yet applied the JUL 2013 CPU, the following trigger will prevent any additional logging of passwords within FND_LOG_MESSAGES.

    In SQL*Plus, login as APPS, and do the following:

    CREATE OR REPLACE TRIGGER
    FND_LOG_MESSAGES_BI
    BEFORE INSERT ON APPLSYS.FND_LOG_MESSAGES
    REFERENCING NEW AS NEW OLD AS OLD FOR EACH ROW
    WHEN (NEW.module like 'fnd.sso.SecureHttpRequest%')
    BEGIN
    :NEW.message_text := 'Ignored';
    END;
    /

    Once the JUL 2013 CPU has been applied, the trigger is no longer required and should be dropped for performance reasons.

    In SQL*Plus, login as APPS, and do the following:

    DROP TRIGGER
    FND_LOG_MESSAGES_BI;

    MITIGATION STEP Cleanup Old Log Entries
    Customers that have applied E-Business Suite CPU patches JUL 2012, OCT 2012, JAN 2013, or APR 2013 will have log entries that need to be purged. For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

    Customers that have applied one of the patches with the vulnerability listed above will likely have log entries that need to be purged. By default, E-Business Suite logs to FND_LOG_MESSAGES. Customers can optionally configure the system to log to a file on the applications tier by setting the AFLOG_FILENAME profile (this parameter can also be set as a java system property or environment variable). See Oracle E-Business Suite System Administrator's Guide - Configuration: Logging for more information on logging configuration.

    For log entries in the database, remove entries in FND_LOG_MESSAGES by either truncating the table or by selectively deleting the problematic rows.

    In SQL*Plus, login as APPS, and do one of the following:
     
    TRUNCATE TABLE FND_LOG_MESSAGES;
     
    or
     
    DELETE FND_LOG_MESSAGES
      where MODULE  like 'fnd.sso.SecureHttpRequest%.secureParse';
    COMMIT;
     
     
    For log files in the file system purge the log files, or you can run the following commands to remove the specific problematic entries:

    For a single file
     
    sed -i  -e '/fnd.sso.SecureHttpRequest/d' file_name
     
    or for multiple files
     
    find /some/dir  -name '*.log' -exec  \
    sed -i -e '/fnd.sso.SecureHttpRequest/d' {} \;

Change passwords for affected accounts

Oracle E-Business Suite administrators that feel this exposure may have compromised the credentials should force the passwords to be changed for the affected accounts. My Oracle Support (MOS) Note 1579709.1 states the following mitigation steps:
    MITIGATION STEP Force a password change for all E-Business Suite accounts (optional)
    If you suspect that logs with passwords have been compromised via the production instance, cloned database copies, or database backups, you should force a password change for all E-Business Suite accounts. For passwords that are managed through OID, passwords should be expired via OID. For passwords managed by E-Business Suite you can force a password change by performing the following steps:

    1. Login to database as the APPS user, and run the following SQL:

    UPDATE FND_USER set PASSWORD_DATE = NULL
      where nvl(END_DATE, sysdate+1) > sysdate
        and USER_NAME not in ('GUEST','AUTOINSTALL','ASADMIN',
            'ORACLE12.0.0','ORACLE12.1.0','ORACLE12.2.0','ORACLE12.3.0',
            'ORACLE12.4.0','ORACLE12.5.0','ORACLE12.6.0','ORACLE12.7.0',
            'ORACLE12.8.0','ORACLE12.9.0');
    COMMIT;

    2. Login to E-Business Suite as the SYSADMIN user. You will be prompted to change the SYSADMIN password. Change the SYSADMIN password.
    3. To change the GUEST password, follow MOS note: 443353.1 - How To Successfully Change The Guest Password In E-Business Suite 11.5.10 and R12
    4. To change the ASASMIN password, follow MOS note: 556540.1 - Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12 - Section: 3.3, Steps: (8 - 11)

    For any additional clarification please contact Oracle Support.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Oracle CorporationAffected30 Aug 201304 Sep 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 4.6 AV:L/AC:L/Au:S/C:C/I:N/A:N
Temporal 4.0 E:H/RL:OF/RC:C
Environmental 3.0 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Jeff Kayser of Jibe Consulting, Inc. for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs: CVE-2013-3749
  • Date Public: 14 Oct 2013
  • Date First Published: 04 Sep 2013
  • Date Last Updated: 04 Sep 2013
  • Document Revision: 25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.