bugtraq - Advisory: Oracle JDeveloper passes Plaintext Password

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050713193622.14573.qmail@securityfocus.com>
Date: 13 Jul 2005 19:36:22 -0000
From: ak@...-database-security.com
To: bugtraq@...urityfocus.com
Subject: Advisory: Oracle JDeveloper passes Plaintext Password


Red-Database-Security GmbH  - Oracle Security Advisory

Oracle JDeveloper passes Plaintext Password


 Name                Oracle JDeveloper passes Plaintext Password
 Systems Affected    Oracle JDeveloper 9.0.4, 9.0.5, 10.1.2
 Severity            Low Risk 
 Category            Information disclosure of Passwords
 Vendor URL          http://www.oracle.com 
 Author              Alexander Kornbrust (ak at red-database-security.com) 
 Date                13 July 2005 (V 1.00) 
 Advisory            AKSEC2003-006
 Oracle Vuln#        AS09
 Time to fix         148 days


Details
#######
Starting an external program and passing the password as a parameter is unsecure. 
This is the easiest way to decrypt an encrypted password. Replace the sqlplus.exe with a fake version which stores the passwords in a local file.

JDeveloper starts sqlplus with the following parameter:
system/alexora1@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=picard)(PORT=1521)))(CONNECT_DATA=(SID=ora10103)))


Workaround
##########
Do not start sqlplus from JDeveloper.


Patch Information
#################
Apply patches for Jdeveloper and / or DeveloperSuite mentioned in Metalink Note 311038 on your Jdeveloper / DeveloperSuite Installation (normally your client PC).


History
#######
14-feb-2005 Oracle secalert_us was informed
14-feb-2005 Bug confirmed
12-jul-2005 Oracle published Oracle Critical Patch Update July 2005
12-jul-2005 Red-Database-Security published this advisory


© 2005 by Red-Database-Security GmbH