PT-2004-2284 · Oracle · Oracle 10G Database Server

David Litchfield · Publicado 2004-08-04 · Atualizado 2016-10-18 · CVE-2004-1367

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle 10g Database Server (affected versions not specified)

Description: The issue arises when the Oracle 10g Database Server is installed with a password containing an exclamation point for the DBSNMP or SYSMAN user. This results in an error that logs the password in the world-readable postDBCreation.log file. Local users could potentially obtain the password and use it to access SYS or SYSTEM accounts if they were installed with the same password.

Recommendations: For Oracle 10g Database Server, consider changing the passwords for the DBSNMP and SYSMAN users to not include an exclamation point, and restrict access to the postDBCreation.log file to prevent unauthorized users from obtaining the password. Additionally, ensure that the SYS and SYSTEM accounts do not use the same password as the DBSNMP or SYSMAN users to minimize potential damage.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2004-1367

Produtos afetados

Oracle 10G Database Server

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1367 · Nota
• http://ngssoftware.com/advisories/oracle23122004D.txt · Aviso do Fabricante
• http://oracle.com/technology/deploy/security/pdf/2004alert68.pdf · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110382247308064&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1367 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA04-245A.html · Nota
• http://kb.cert.org/vuls/id/316206 · Nota