bugtraq - Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Oct 2005 09:38:41 -0000
From: ak@...-database-security.com
To: bugtraq@...urityfocus.com
Subject: Plaintext Password Vulnerabilitiy during Installation of Oracle
 HTMLDB

Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB 
#######################################################################

 Name                Cross-Site-Scripting Vulnerabilities in Oracle XMLDB
 Systems Affected    Oracle HTMLDB
 Severity            Low Risk 
 Category            Plaintext Password of SYS is logged during Installation of HTMLDB
 Vendor URL          http://www.oracle.com 
 This advisory       http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.html
 Author              Alexander Kornbrust (ak at red-database-security.com) 
 Date                7 October 2005 (V 1.00)

Details
#######
Oracle HTML DB is a rapid web application development tool for the Oracle 
database. Using only a web browser and limited programming experience, it is 
possible to develop and deploy professional-looking applications that are both 
fast and secure. 

During the manuell installation of HTMLDB the SYS password is logged in plaintext 
into the file install.lst. The SYS password should never be stored in a text file 
in clear text. 

Affected Products
#################
Oracle HTMLDB 

Testcase 
########

Extract from install.lst: 

>> Is this a (1) New install or an (2) Upgrade? [1] 
>> What is your connect string (Enter for none)? [] ora902 
>> What is your Oracle SYS password? [CHANGE_ON_INSTALL] mysecretpassword1 

Patch Information
#################
This bug is fixed with Critical Patch Update April 2005 (CPU April 2005). Oracle forgot 
to inform Red-Database-Security that this bug is fixed with CPU April 2005.
Oracle also forgot to mention Red-Database-Security in the credits of CPU April 2005.

All already published alerts are available on the web site of Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html

Workaround
##########
Delete the file install.lst manually.

History
#######
26-jan-2004 Oracle secalert was informed

27-jan-2004 Bug confirmed

13-apr-2005 Oracle published CPU April 2005 without informing Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory

© 2005 by Red-Database-Security GmbH - last update 7-october-2005